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ADMINISTRATIVE HANDLING INSTRUCTIONS 


1 . The title of this document is Top Officials {TOPOFF) 3 (T3) After-Action Report. 

2. WARNING: This document is FOR OFFICIAL USE ONLY (FOUO). It contains 
information that may be exempt from public release under the Freedom of 
Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, 
distributed, and disposed of in accordance with Department of Homeland Security 
(DHS) policy relating to FOUO information and is not to be released to the public 
or other personnel who do not have a valid “need-to-know” without prior 
approval of an authorized DHS official. 

3. Reproduction of this document, in whole or pail, without prior approval of 
National Exercise Division, DHS/FEMA, is prohibited. 

4. The T3 After-Action Report is broken into several sections, annexes, and 
appendices. All of these sections remain FOUO when separated from the 
document. 

5. The DHS/FEMA, National Exercise Division, is the control authority for the T3 
After-Action Report. Ms. Sandra Santa Cosgrove, Acting Branch Chief, National 
Exercise Division, DHS/FEMA can be reached via e-mail at 
sandra.santa@dhs.gov and via telephone at 202-786-9594. 
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T3 After-Action Report User Guide (A Road Map) 

This After-Action Report (AAR) is a compilation of several documents, all of which are 
related to the design and conduct of the Top Officials (TOPOFF) 3 (T3) series of events. 
As a comprehensive reference guide to T3, it has been organized and sectioned to enable 
its users to review or access information relevant to their research interest. 

The depth of detail of the report is considered sufficient to build context around core T3 
issues and allow interested professionals to consider possible altematives/improvements 
to address policy or procedural .shortcomings within their respective Department/Agency 
(D/A). Requests for additional data not included in this report are to be directed through 
the Acting Branch Chief, National Exercise Division, DHS/FEMA, Ms. Sandra Santa 
Cosgrove, Sandra.Santa@dhs.gov, or 202-786-9594. 

The recommendations offered in the AAR are intended to stimulate action toward 
improving capabilities and performance or resolving an issue or deficiency. The 
assessments that went into these recommendations were not intended to have the depth 
and granularity required to be considered on their own, fully “actionable” prescriptions 
for an organization or any element within an organization. 

Every attempt has been made to avoid redundancy throughout the report; however, given 
that several of the annexes are stand-alone documents, some redundancy is unavoidable. 
Two synopses, the Executive Overview and the T3 AAR Summary Report, are similar in 
nature: however, due to their development background, have subtle differences. Both of 
these abridgments provide an excellent outline of T3 issues that surfaced as a result of the 
Full-Scale Exercise (FSE). The Executive Over\’iew is simply an overview written for 
senior leaders. Its content has been gleaned from a multitude of D/A input. The T3 AAR 
Summary Report is very similar in content, but has been compiled from the AAR and 
therefore is supported by the findings of the T3 evaluation team. 

The following category descriptions supplement the content map below: 

I. Exercise Overview 


The Overview consists of a summary of TOPOFF series history, information on TOPOFF 
building block events, evaluation methodology, reconstruction data, and exercise 
artificialities. 

A. Building Blocks 

The T3 FSE is the pinnacle of a series of building block events that occurred during the 
18 months leading up to the FSE. Each event preceding the FSE and the one follow-on 
exercise were designed to build upon the stated goals and objectives established by all 
participating Federal, State, and local D/As. 

UNCLASSIFIED 

This Document Contains Canadian and United Kingdom Information 

iii 





AAR 


TOPOFF 3 


B. Evaluation Methodology 

This section provides a description of the T3 FSE evaluation methodology, based on the 
approach outlined in Homeland Security Exercise and Evaluation Program Volume II: 
Exercise Evaluation and Improvement (https://odp.esportals.coni/login.cfm). This 
approach provides participants and response agencies with information that they can use 
to improve their response policies and procedures to incidents of national significance. 
The analysis also provides information that some organizations may find useful for their 
internal evaluations. 

C. Exercise Event Reconstruction 

This section provides a fact-based, time-synchronized, de-conflicted, and meaningful 
account of what actually happened during the T3 FSE. 

D. Exercise Artificialities 

This section includes a description of T3 FSE artificialities that represent either deliberate 
choices made during the design of T3 or are specific to this particular exercise (as 
opposed to exercises in general). These choices were made with the understanding that 
they would have impacts on exercise findings. The T3 evaluation team believes that these 
impacts are accounted for in the exercise analysis. 

II. Exercise Goals and Objectives 

This is a one-page summary of the objectives of the T3 FSE. 

III. Scenario 


This section contains an overview of the T3 FSE scenario. The T3 FSE scenario provides 
an environment for participants — primarily top-level decision makers — to exercise 
against a credible terrorist adversary that plans and executes multiple attacks employing 
weapons of mass destruction. Although the scenario is plausible, it contains artificialities 
necessary to create conditions required to achieve exercise goals and objectives. The 
chain of events depicted in the scenario is hypothetical, and the terrorist groups and 
individuals portrayed in the scenario are fictional. 

IV. Analysis of Mission Outcomes 

This section contains identification of the ten topical areas analyzed including the four 
issues identified as Broad Mission Outcomes; the Homeland Security Advisory System, 
Joint Field Office, Resource Requesting/Coordination, and Information Sharing. 
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V. Analysis of Critical Task Performance 

This section of the report reviews performance of critical tasks as identified by the 
HSEEP Volume II Exercise Evaluation Guide (EEG) including: Stafford Act 
Declarations, Emergency F*ublic Information, Integrating Responses to Incident of 
National Significance: Public Health Emergency and the Stafford Act, the Strategic 
National Stockpile and Points of Distribution, Agent Confirmation and Hazard Area 
Definition, and Emergency Response Operations under a Unified Command. 

VI. Conclusions 


This section summarizes the primary issues or observations and recommended courses of 
action associated with each of the ten analysis topics. 

VII. Annexes 


• Intelligence 

This annex provides a For Official Use Only (FOUO) summary of the intelligence 
element of T3, including the 30-day pre-FSE activities and events. 

• Private Sector 

This annex provides a summary of private sector integration and exercise play 
assessment. T3 reflected the first major involvement of the private sector in the 
TOPOFF series. 

• CT Cyber 

This annex provides details associated with the cyber exercise in Connecticut. 

• NJ Cyber 

This annex provides details associated with the cyber exercise in New Jersey. 

• Acronym List 

• Executive Overview 

This annex contains a 24-page summary of exercise issues gleaned from multiple 
D/A input, and was written for executive leadership review. 

• International 

International play in T3 was primarily focused on the involvement of the United 
Kingdom (UK) and Canada. This annex provides integration and exercise play 
assessment of the UK and Canadian events and actions. 


UNCLASSIFIED - FOUa 

This Document Contains Canadian and United Kingdom Information 


V 





THIS PAGE INTENTIONALLY LEFT BLANK 


UNCLASSIFIED - FOUO 

This Document Contains Canadian and United Kingdom Information 


VI 





AAR 


TOPOFF 3 


T3 AAR Table of Contents 


HANDLING INSTRUCTIONS i 

USER GUIDE iii 

EXECUTIVE SUMMARY ES-1 

PART 1: EXERCISE OVERVIEW 1 

EXERCISE NAME I 

DURATION I 

EXERCISE DATE I 

SPONSOR I 


FEDERAL EXERCISE PROJECT OFFICER 

TYPE OF EXERCISE 

FUNDING SOURCE 

PROGRAM 

FOCUS 


CLASSIFICATION 2 

SCENARIO 2 

LOCATION 2 

PARTICIPATING ORGANIZATIONS 2 

NUMBER OF PARTICIPANTS 7 

EXERCISE OVERVIEW 8 

EXERCISE EVALUATION 13 

PART 2: EXERCISE GOALS AND OBJECTIVES 35 

PART 3: EXERCISE EVENTS SYNOPSIS 37 

SCENARIO 47 

PART 4: ANALYSIS OF MISSION OUTCOMES 59 

THE HOMELAND SECURITY ADVISORY SYSTEM (HSAS). STATE THREAT 
CONDITIONS. AND ASSOCIATED PROTECTIVE MEASURES 60 

JOINT FIELD OFRCE OPERATIONS (JFO) 76 

RESOURCE REQUESTS AND RESOURCE COORDINATION 95 

INFORMATION SHARING 124 

PART 5: ANALYIS OF CRITICAL TASK PERFORMANCE 149 

STAFFORD ACT DECLARATIONS 1 50 

EMERGENCY PUBLIC INFORMATION 160 

INTEGRATING RESONSES TO INCIDENTS OF NATIONAL SIGNIFICANCE: 

PUBLIC HEALTH EMERGENCY AND THE STAFFORD ACT 1 92 

THE STRATEGIC NATIONAL STOCKPILE (SNS) AND POINTS OF 
DISPENSING (PODS) 203 

AGENT CONHRMATION AND HAZARD AREA DEFINITION 225 

EMERGENCY RESPONSE OPERATIONS UNDER A UNIFED COMMAND 248 

PART 6: CONCLUSIONS 267 


vii 




AAR 


TOPOFF 3 


ANNEXES 

ANNEX A; EXECUTIVE OVERVIEW A- 1 

ANNEX B; INTELLIGENCE PLAY B-1 

ANNEX C: PRIVATE SECTOR PLAY C- 1 

ANNEX D: CYBER EXERCISE IN CONNECTICUT D-1 

ANNEX E: CYBER EXERCISE IN NEW JERSEY E- 1 

ANNEX F: ACRONYM LIST F- 1 

ANNEX G: TOP OFFICIALS 3/ATLANTIC BLUE/TRIPLE PLAY 

INTERNATIONAL AFTER ACTION REPORT— PUBLISHED SEPARATELY G- 1 


viii 




AAR 


TOPOFF 3 


Executive Summary 


I. Introduction 

This T3 Summary Report summarizes the findings/lessons of T3 After-Action Report 
(AAR) and provides a list of recommended remedial actions that address deficiencies and 
recommendations for improved performance. It is intended to provide a brief overview of 
key issues addressed in greater detail in the body of the AAR. Refer to the full AAR for a 
more extensive analysis of exercise actions based on information recorded by exercise 
data collectors located at key Emergency Operation Centers (EOCs) and exercise sites 
during the Full-Scale Exercise (FSE). 

II. Background 

T3 was a Congressionally mandated, national counterterrorism exercise designed to 
identify vulnerabilities in the nation’s domestic incident management capability. It 
exercised the plans, policies, procedures, systems, and facilities of Federal, State, and 
local (FSL) response organizations against a series of integrated terrorist threats and acts 
in separate locations in the northeastern United States. 

In coordination with T3, the United Kingdom and Canada conducted simultaneous and 
related exercises (Atlantic Blue in the United Kingdom and Triple Play in Canada) 
designed to improve mutual response and preparedness against global terrorism. The 
planning and execution of the three exercises provided an excellent opportunity for 
international cooperation, networking of key responders, and sharing of information on 
concepts of emergency operations. 

III. Goals 

The following objectives were established to direct the exercise design process for T3: 

• Incident management : To test the full range of existing procedures for 
domestic incident management of a weapon of mass destruction (WMD) 
terrorist event and to improve top officials’ capabilities to respond in 
partnership. 

• Intelligence/Investigation : To test the handling and flow of operational and 
time-critical intelligence between agencies in response to a linked terrorist 
incident. 

• Public information : To practice the strategic coordination of media relations 
and public information issues in the context of a WMD terrorist incident. 

• Evaluation : To identify lessons learned and promote best practices. 

With these four objectives as a guide, FSL, tribal, private sector, and other organizations 
created their own goals and objectives for evaluation through the exercise process. New 
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Jersey and Connecticut planners identified specific goals that focused the exercise design 
process on key issues within their respective States. 

IV. Scenario Development 

The T3 FSE scenario provided an environment for participants — primarily top-level 
decision makers — to exercise against a credible terrorist adversary that had planned and 
executed an attack employing WMDs. As described in Homeland Security Exercise and 
Evaluation Program (HSEEP) Volume III, a scenario for an objectives-based exercise 
should provide sufficient background and technical information to drive exercise play, 
yet remain at a reasonable level of complexity to avoid overwhelming the exercise 
players. Accordingly, the T3 FSE scenario was realistic, plausible, and designed to 
provide an accurate and comprehensive portrait of real-world threats related to exercise 
conditions described in the Homeland Security Council’s Illustrative Planning Scenarios 
(IPSs). The T3 FSE scenario accommodated Department of Homeland Security Office of 
State and Local Government Coordination and Preparedness (DHS/SLGCP)-approved 
exercise objectives and included credible, hypothetical situations that created an 
internally complete and consistent world in which conditions influenced player activities 
and created decision-making opportunities. 

Use of real-world intelligence systems to test the handling and flow of intelligence was a 
primary goal for the T3 FSE. To avoid the legal implications of exercising against actual 
terrorist groups, networks, or individuals, and to ensure that the exercise remained at the 
lowest possible classification level, the T3 FSE scenario employed a fictionalized 
threat — the Universal Adversary (UA). Although the names of UA groups and 
individuals were fictional, this credible, highly adaptive adversary was based on 
unclassified intelligence estimates describing known terrorist motivations, capabilities, 
intentions, organizations, strategies, operation.s, tactics, techniques, and procedures. 

The T3 scenario contained the following elements: 

• A biological attack in New Jersey 

• A chemical and vehicle-borne improvised explosive device (VBIED) attack in 
Connecticut 

• Multiple VBIED attacks in London 

• A salmonella outbreak on a cruise ship in Canada 

V. Exercise Artificialities 

By their nature, exercises are not real events and, consequently, are influenced by 
constrained factors that are collectively known as artificialities. Although every attempt is 
made to mitigate the effects of artificialities, they will occur and can affect the outcomes 
of the exercise. If the nature and effects of artificialities are not taken into account, the 
conclusions drawn from the exercise could be incorrect. Artificialities surface in any 
exercise involving the response to a WMD event. The fundamental issue is that it is often 
impossible to exercise the full scope of a real-world event — ranging from an actual bomb 


UNCLASSIFIED - FOUS - 

This Document Contains Canadian and United Kingdom Information 

ES-2 





AAR 


TOPOFF 3 


detonation to shutting down transportation infrastructure to commanding the full-time 
attention of top officials. The result is that many exercise events or actions must be 
notional or simulated, instead of actual. Despite the notional character of some events, 
governmental agencies and organizations played as though the events actually took place. 
This allowed the T3 evaluation team to examine decision-making, coordination, and 
communication issues. The evaluation team accounted for T3 artificialities in the analysis 
process to ensure proper interpretation of the exercise results. 

VI. Evaluation Methodology 

A. Introduction 

The evaluation of the T3 FSE intended to: 

• Assess and enhance FSL terrorism preparation, prevention, response, and 
recovery capabilities. 

• Provide objective observations of complex, multifaceted interactions of FSL 
entities. 

• Provide recommendations for improving FSL counterterrorism incident 
management policies and procedures. 

• Provide a basis for assessing progress and improvement over time and against 
the backdrop of evolving policies and procedures. 

The T3 FSE evaluation focused on high-level FSL coordination, support plans, policies, 
and procedures. In addition to the evaluation presented in this summary and in the full 
AAR document, organizations that participated in the exercise were encouraged to 
conduct their own internal evaluations based on their specific objectives, tasks, and 
procedures. 

B. Methodology 

The T3 FSE evaluation methodology is based on the approach outlined in HSEEP 
Volume II: Exercise Evaluation and Improvement. The overall aim of the evaluation is to 
document what happened during the exercise and explain why. This methodology 
provides participants and response agencies with information they can use to improve 
their response policies and procedures to Incidents of National Significance (INS). The 
analysis also provides information that some organizations may find useful for their 
internal evaluations. Evaluation consists of the following three steps; 

1 . Observation: collecting data 

2. Reconstruction: determining what happened and when 

3. Analysis: determining why specific actions or events occurred. 

/. Observation 

To systematically determine what happened in an exercise, dedicated observers known as 
data collectors must be assigned wherever exercise play occurs. The number of data 
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collectors at any one location depended on the scale or intensity of play, number of 
players, or geographic spread of the location. Analysts were available in each venue to 
supplement data collectors at key exercise sites, such as State EOCs or Joint Field Offices 
(JFOs). 

Data collectors were not the only observers at the T3 FSE who provided data for analysis. 
T3 FSE players, controllers, simulation cell (SIMCELL) staff, and the Virtual News 
Network (VNN) also contributed critical data to the analy.sis. Players provided data by: 

• Completing questionnaires (player feedback forms); 

• Providing copies of logs, e-mails, and other documentation developed during the 
T3 FSE; 

• Contributing to their organization’s lessons learned; and 

• Contributing to relevant Hotwashes. 

This input was critical to the analysis, as it represents players’ perspectives on the 
exercise and their actions/decisions. Exercise support personnel provided controller logs, 
SIMCELL logs, and VNN reports to the analysts. 

In addition to data collected during the T3 FSE, a Hotwash was conducted immediately 
after the exercise in each venue, followed by an After-Action Conference. Data from all 
of these events were collected to obtain additional player feedback, ensuring a complete 
and comprehensive overview of the critical aspects of the exercise. 

2. Reconstruction 

Reconstruction produced a fact-based, time-synchronized, deconflicted, and meaningful 
account of what happened during the exercise. This laborious process is essential for 
conducting a meaningful analysis. Reconstruction involved the following aspects: 

• Independent and parallel reconstruction of events at each location by analysts 
assigned to one or more locations; 

• Group reconstruction of how the events at each location fit in with those at the 
other locations; this step typically engenders considerable revision of the 
individual analyst’s initial reconstruction of events at his/her location; and 

• Creation of a single, integrated reconstruction report. 

The full AAR contains a more detailed account of the reconstruction process. Only an 
abridged version of the complete T3 FSE reconstruction is provided in this report. 

3. Analysis 

In this final step of the evaluation process, analysts used the record of events provided by 
the reconstruction to objectively seek patterns and develop an understanding of why 
certain issues emerged during the exercise. The analysis of these issues includes detailed 
descriptions of the issues and, when relevant, potential explanations for the behavior or 
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result. The T3 FSE analysis also identifies areas for improvement and recommends 
courses of action for strengthening the ability of FSL organizations to respond to 
emergencies. FSL agencies will use these results to develop improvement plans. 

VII. Analysis 

In an exercise as large in scope and as complex as T3, the opportunities for analysis were 
significant. Based on post-exercise meetings among participants, the T3 After-Action 
Conference, and observations by subject-matter experts during the exercise, 10 elements 
of the exercise were selected for in-depth analysis. These topics, listed below, are 
summarized in this report: 

• Strategic National Stockpile (SNS) and Points of Dispensing (PODs) 

• Homeland Security Advisory System (HSAS), State Threat Conditions, and 
Associated Protective Measures 

• Stafford Act Declarations 

• Integrating Responses to Incidents of National Significance: Public Health 
Emergency and the Stafford Act 

• Emergency Response Operations Under a Unified Command (UC) 

• JFO Operations 

• Agent Confirmation and Hazard Area Definition 

• Resource Requesting and Resource Coordination 

• Information Sharing in the T3 FSE 

• Emergency Public Information 

The selection of these topics is not meant to indicate that other issues were not worthy of 
analysis. Rather, these issues reflect sequences of events that attracted great interest, 
involved new organizations and procedures, and revealed elements of the exercise that 
seemed particularly problematic or well-played. Nothing should be presumed about a 
topic or issue that was not selected for analysis. The brief description of each topic in this 
document should not be considered authoritative; a standalone section for each topic is 
included in the full AAR. 

A. Strategic National Stockpile (SNS) and Points of Dispensing (PODs) 

The release of Yersinia pestis (plague) in New Jersey prompted State officials to request 
SNS support and prompted Federal and State officials to activate nearly 400 PODs 
throughout the State to provide prophylaxis to all residents. Analysis of the T3 FSE data 
suggests that this plan was not executable. Distribution of prophylaxis was hampered by 
the short incubation period of plague, a fragmented Federal and State planning process, 
and resource management issues. 

Comparatively, few problems were observed during the delivery and distribution of the 
SNS. There was some initial uncertainty about the SNS request and problems integrating 
Federal plans for SNS deployment with the State; however, the T3 participants 
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Throughout the year-long development process for the T3 New Jersey pneumonic plague 
scenario, a dedicated team from the AMTI prime contractor and the CDC painstakingly 
developed an epidemiologically sound progression model for the spread of the Plague in 
New Jersey. Based on this model. New Jersey scheduled a highly ambitious exercise play 
for its entire state hospital and local health organization infrastructure for the mass 
distribution of medications to combat the Plague. Based on real life resource constraints, 
every organization that could play did so and more robust participation was simulated. 
Had the Master Scenario Events List progression of spreading Plague been allowed to 
play out as designed, a more orderly medical response would have been anticipated 

/. Observations 

• The throughput of the PODs fell short of the goal of processing 1 ,000 persons per 
hour, which was established in the New Jersey Mass Prophylaxis Manual. The 
average rate achieved among the 22 New Jersey PODs was approximately 500 
people per hour. Reasons for the discrepancy should be identified. 

• The plan to conduct prophylaxis on this scale evolved during the course of the 
exercise and did not appear to reflect a preplanned and carefully integrated 
Federal and State response. 

• It is not clear that the Federal government has a strategy or plan for implementing 
its own system of PODs or for rapidly identifying and supplying staff to support 
State efforts in the event of a large-scale requirement. 

2. Recommendations 

• States need to work with the Federal government to develop scalable prophylaxis 
plans that address the need to reach very large numbers of people. T3 indicates 
the difficulty of doing this while an event is unfolding. 

• Integrate Federal and State planning processes to ensure that mass prophylaxis 
plans will be executable if needed. 

• The Federal government should decide whether it will be in the business of 
establishing and operating its own PODs in the event of a major public health 
emergency as occurred during T3. 

B. Homeland Security Advisory System (HSAS), State Threat Conditions, and 
Associated Protective Measures 

The Homeland Security Presidential Directive (HSPD)-3 created the HSAS to improve 
coordination and communication in the event of terrorist attacks. First, the HSAS informs 
FSL governments and the public of the perceived credibility and imminence of threats. 
Second, it directs a systematic, coordinated governmental response to such threats to 
"reduce vulnerability or increase response capability.” To date, elevations of the HSAS 
threat condition to Red have only occurred in response to notional attacks during 
exercises. The HSAS level has never been elevated to Red in an exercise or real-world 
setting on a preattack basis. 
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Implementation of the HSAS, and specifically the Red threat condition, has been closely 
examined and critiqued in three previous exercises — the T2 FSE, T3 Command Post 
Exercise (CPX). and SOE FY04-4 Crimson Dawn. The T3 FSE demonstrated that the 
HSAS is still not used in a systematic manner, and therefore it is not effectively achieving 
the objectives listed in HSPD-3. 

1. Observations 

• Real-world and exercise elevations of the HSAS level to Orange and Red reveal 
that implementation of the HSAS is not systematic. 

• There does not appear to be a formal mechanism for coordinating, reporting, and 
tracking changes to HSAS and State threat levels and implementation of 
associated FSL and private sector protective measures. 

• The absence of a mechanism for coordinating the implementation of protective 
measures under changing HSAS levels contributed to an uncoordinated response. 

• Unintended consequences of implementing HSAS Red protective measures were 
not well-understood. 

• Officials in the T3 FSE used the HSAS and State homeland security advisory 
systems as a means to facilitate emergency response operations more than as 
threat advisory systems. 

• Inconsistent messages and little specific public guidance limited the value of the 
HSAS as a warning/advisory system. 

2. Recommendations 

• Develop a formal process for coordinating and tracking implementation of severe 
(Red-level) protective measures across FSL governmental agencies and the 
private sector. 

• Provide more specific guidance regarding the color-coded threat conditions than 
the general guidance currently provided in HSPD-3, and link the levels to specific 
protective measures. 

• Re-examine and refine the desired purposes of the HSAS: public 
waming/advisory, attack prevention, and/or emergency response. 

C. Stafford Act Declarations 

There were several declarations and proclamations of emergencies and disasters during 
the T3 FSE. State and local Jurisdictions in both exercise venues invoked their authorities 
to declare emergencies and also requested Federal assistance under the Stafford Act. 
These requests led to presidential declarations of a major disaster in Connecticut and an 
emergency in New Jersey. 

As in the T2 FSE, participants discussed the applicability of a major disaster declaration 
under the Stafford Act to terrorist attacks, especially to attacks that feature nonexplosive 
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biological weapons. Although the governor of New Jersey requested a major disaster 
declaration. New Jersey received an emergency declaration. 

1. Obserx’ations 

• It remains unclear whether an incident with a non-explosive biological, chemical 
or radiological weapon would fit the definition of a major disaster under the 
Stafford Act. 

• Other Federal programs may provide assistance in lieu of a major disaster 
declaration; however, the pursuit of these programs diverts State and local 
resources from other response and recovery activity. 

• Provisions within the Stafford Act provide for the possibility of exceeding the $5 
million limit in assistance funding that would most likely be invoked after a 
terrorist incident. 

• Lack of feedback to agency staffs on verbal approvals of presidential declarations 
caused initial uncertainty regarding the type of declaration and assistance 
approved. 

2. Recommendations 

• Determine the applicability of a Stafford Act major declaration to non-explosive 
incidents involving WMD, particularly those involving a laige-scale bioterrorism 
incident. 

• If these types of incidents do not fit the definition of a major disaster declaration, 
determine whether exemptions within the Stafford Act for emergency declarations 
and other Federal programs can result in an equivalent level of assistance and are 
made aware to the States. 

• Consider legislation to ensure the Stafford Act major disaster declaration covers 
all hazards and is applicable to terrorist events. 

• Until legislation is passed, that would allow these types of incidents to receive the 
full range of Federal assistance provided under a major disaster declaration, 
identify other Federal programs that may be able to provide assistance. 

D. Integrating Responses to Incidents of National Significance: Public Health 
Emergency and the StafTord Act 

The Secretary of the Department of Health and Human Services (HHS) declared a public 
health emergency in New Jersey under the authorities of the Public Health Service Act. 
As discussed earlier, the president approved Stafford Act declarations for the incidents in 
New Jersey and Connecticut. Additionally, the T3 FSE tested the recently released 
National Response Plan (NRP). It was the first opportunity to examine the guidance the 
NRP provides in coordinating incidents of national significance (INSs). 

The T3 FSE revealed that the NRP does not provide adequate guidance for coordination 
of Federal operations and support under a public health emergency when a Stafford Act 
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declaration is in effect. Specifically, the processes were unclear regarding the process 
required to request and coordinate Federal assistance under other Federal authorities in 
conjunction with a Stafford Act declaration. The relationship between the public health 
emergency and the Stafford Act declarations was further clouded by HHS' lack of an 
established process for coordinating Federal-to-Federal support. Additionally, the funding 
responsibilities of State and local governments under a public health emergency were not 
clearly defined. 

/. Observations 

• Neither the NRP nor the HHS concept of operations (CONOPS) provides 
sufficient guidance for coordinating assistance for incidents covered under a 
Stafford Act declaration in conjunction with a public health emergency (or other 
Federal authorities). In some cases, the information conflicts. 

• HHS does not have a detailed process for requesting and coordinating Federal-to- 
Federal assistance. 

• Funding capabilities and responsibilities under a public health emergency are 
unclear. 

2. Recommendations 

• Clarify the process for Federal-to-Federal support for non-Stafford Act assistance 
in conjunction with a Stafford Act declaration. 

• Develop a transition plan for coordinating incidents that start under non-Stafford 
Act authorities but later grow to include a Stafford Act declaration. 

• Develop a process for Federal-to-Federal support under a public health 
emergency. 

• Clarify the funding capabilities and responsibilities of the State, HHS, and other 
Federal agencies under a public health emergency. 

E. Emergency Response Operations under a Unified Command 

The National Incident Management System is the federally-mandated system for 
managing emergency responses. NIMS uses the Incident Command System (ICS) to 
integrate an organizational structure that can scale up or down to effectively meet the 
demands of an incident. It allows for an integrated organizational structure that can scale 
up or down to effectively meet the demands of an incident. When multiple organizations 
or jurisdictions have responsibility over aspects of the tactical response, a UC may be 
formed to link organizations or municipalities together, provide a forum for integrated 
decision making, and allow a coordinated approach to incident response. 

The T3 FSE provided an opportunity to exercise the integrated ICS approach in 
Connecticut with the formation of a UC. 
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}. Observations 


• There was inadequate integration between the off-site Unified Command Post 
(UCP) and activities at the incident scene. 

• Integration of the UCP with other emergency response organizations and EOCs 
remains a challenge. 

• Concern exists regarding the alignment between the National Oil and Hazardous 
Substances Pollution Contingency Plan (NCP) and NRP, which plays out most 
significantly at the UC. 

2. Recommendations 

• Rework the information flow processes involving the UC to include local and 
State EOCs, even when using direct Federal support or NCP authorities. 

• Discuss the development of a National IMAT with interagency membership, as 
opposed to a Coast Guard-only IMAT 

• Expand the NRP to include discussion of the UC — its scope of responsibilities 
and interactions with other emergency response centers. 

• Develop criteria for an IC to use to determine the circumstances under which it is 
appropriate to stand-up a UC. 

F. JFO Operations 

The T3 FSE provided an opportunity to exercise the recently codified JFO concept and 
identify issues that could impede the JFO’s ability to support emergency response 
operations. The events in Connecticut and New Jersey prompted Federal officials to 
activate JFOs and select PFOs for both States. During the exercise, the JFO and PFO 
staffs focused their efforts on integrating the Federal and State response efforts by 
arranging resource support, coordinating response policies and operations, and sharing 
information. 

Observations made during the exercise indicate that JFO operations were problematic in 
both States. The JFO staff encountered problems coordinating their activities and support 
with State officials. More prominently, the JFO staff also had trouble coordinating the 
activities among the JFO staff elements. 

I. Observations 

• The lines of authority and coordination inside the JFO were unclear. 

• The presence of the PFO cell complicated JFO operations. 

• The JFO did not always follow standard processes for sharing information 
internally. 

• Resolving these internal structural and process issues would ultimately strengthen 
the JFO’s ability to coordinate Federal and State response efforts (i.e., address the 
JFO’s external coordination effort.s). 
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2. Recommendations 

• Clarify the lines of authority for the PFO, FCO, and JFO cell. 

• Document the role and responsibilities of the PFO cell in the NRP and JFO 
standard operating procedures (SOP). 

• Develop and implement processes and procedures that JFO staffs can use to share 
information internally. 

G. Agent Confirmation and Hazard Area Definition 

In a chemical, biological, or radiological attack, early identification of the agent 
combined with clear definition of the hazard area and the potentially exposed population 
can save lives, speed effective treatment of symptoms, and prevent injury to medical 
responders. Until recently, there was no single Federal source for collecting data and 
producing the modeling products used by decision makers. The T3 FSE provided the 
opportunity to observe the progress made in creating a single authoritative Federal source 
for plume modeling. It also highlighted issues regarding the coordination of data and 
information to confirm the agent and define the hazard area. 

The T3 FSE highlighted the potential for tension when many organizations participate in 
the sampling process and when information about the agent is not systematically 
distributed among response organizations. In Connecticut, the Interagency Modeling and 
Atmospheric Analysis Center (IMAAC) was the sole Federal source of plume modeling. 
Observations indicate that this single-source approach resolved much of the confusion 
about plume models noted during previous exercises. IMAAC products provided 
authoritative plume predictions that were used by all the response organizations to define 
the hazard area and make associated decisions; however, problems with version control 
as well as lack of consolidation and confirmation of model inputs were evident. 

1. Observations 

• Specialized incident site response units did not exhibit a clear understanding of 
each other’s roles, authorities, and SOPs. 

• The lack of a formally defined information flow process from the incident site 
resulted in premature public messages and decisions regarding the identity of the 
chemical agent. 

• The IMAAC did not appear to have adequate procedures to deal with 
discrepancies or contradictions in inputs or modeling requests from various 
agencies. 

2. Recommendations 

• Clarify response organizations’ roles and responsibilities at the incident site, 
including the timing of those responsibilities and their value to the larger response 
operation. 
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• Continue to develop IMAAC processes for receipt and review of other modeling 
products and establish a protocol for other modeling agencies to distribute to their 
product and their guidelines for use. 

• Clarify the responsibilities, authorities, and mechanisms for the IMAAC to 
formally disseminate critical information learned through its scientific analysis of 
the incident. 

H. Resource Requests and Resource Coordination 

The T3 FSE provided an opportunity to exercise the process of providing Federal support 
to States that have been overwhelmed by a significant terrorist attack involving WMDs. 
After the releases of Y. pesris and mustard agent, officials in New Jersey and Connecticut, 
respectively, requested a variety of resources from the Federal government, including 
medical supplies, healthcare professionals, transportation support, security personnel, 
mortuary affairs teams, and decontamination units. In addition to these State requests, 
Federal agencies pushed assets to support the State responses. 

Observations indicate that the process of resource allocation was problematic in both 
States. State and Federal officials were uncertain about what had been requested, who 
had requested it, and what was being provided. These issues and the delays they caused 
encumbered the allocation of resource process in the T3 FSE and frustrated participants. 
Resolving these issues would strengthen the ability of State and Federal officials to match 
the resource needs of responders with available assets. 

I. Observations 

• Participants used three different processes for allocation of resources that were 
not well coordinated. 

• Federal and State officials struggled with the implementation of these processes to 
allocate resources. 

• Reliable information about resources was not readily available. 

2. Recommendations 

• Develop a unified Federal emergency process for the allocation of resources. 

• Provide States with a team of subject-matter experts on the allocation of 
resources. 

• Document the mission assignment process within the NRP. 

• Clarify the role of the Secretary’s Emergency Response Team (SERT) during 
emergencies that also involve a JFO. 

1. Information Sharing in the T3 FSE 

Accurate and timely sharing of information and the resulting development of a Common 
Operational Picture (COP) are critical for the success of an integrated FSL response to 
domestic emergencies. Despite efforts to improve communications and information 
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sharing across response organizations, the lack of shared situational awareness and the 
dissemination of incorrect information remain significant roadblocks to a coordinated 
emergency response. 

Other sections of the AAR touch on information sharing and the coordination problems 
associated with resource requests and coordination, agent identification, status of 
advisory levels, and integration of operations centers into the response, among others. 

1. Observations 

• Information systems used in T3 were largely stove-piped within agencies and/or 
response communities. 

• The vast number of operating centers activated during T3 negatively affected 
information sharing by increasing the scope and complexity of the problem. 

• The use of informal or alternate channels for sharing information caused problems 
by enabling circular reporting and bypassing authoritative sources. 

• The T3 FSE revealed a lack of uniform reporting guidelines and procedures for 
validating information received from secondary or tertiary sources. 

• Agencies and operations centers acted and made decisions on different 
information. 

• Situational awareness was not effectively shared across operating centers and 
agencies. 

2. Recommendations 

• Support the development of interoperable information systems and/or a suite of 
emergency response/management applications that can be used across response 
communities. 

• Assess the role and responsibilities of each EOC and consider reducing their 
number, consolidating them, or collocating personnel. 

• Require that all casualty numbers are attached to a clear description of the 
information included in the report. 

• Identify key terms that are likely to appear during a WMD response, standardize 
their definitions, and then disseminate the information across the entire response 
network. 

• Establish mechanisms to update and disseminate new definitions during response 
operations. 

• Consider the development of a DHS field operations guide that lists radio 
frequencies/preferences of federal, state and local responders to expedite the 
development of communications plans. 
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• To build an accurate and effective common operating picture, the response 
network needs to: 

o Identify and define the overlapping critical information required by all the 
responding communities. 

o Establish specific reporting protocols and guidelines for all levels of 
government. 

o Identify the authoritative sources for EEls and which EEls should be 
included. 

o Identify an operating center at each level of the response to act as “keeper 
of the critical information.” 

o Develop protocols for horizontal and vertical coordination (i.e., 

horizontally across one level of government and vertically between levels) 
to align the operational pictures developed and maintained by different 
operating centers. 

J. Emergency Public Information 

The term “emergency public information” reflects an understanding that public 
information during an emergency might differ from normal, day-to-day public 
information provided to citizens by the government. In the event of a major disaster or 
emergency, this often means the coordination, development, and delivery of time-critical, 
lifesaving information to potentially affected people. In a climate of heightened 
uncertainty and concern, the liming and content of official statements can save lives. The 
media and general public are likely to scrutinize these statements, and some statements 
could incur heightened legal or political liabilities. 

The policies, procedures, and mechanisms employed by participating FSL departments 
and agencies and/or nongovernmental organizations to communicate with the public were 
aggressively stressed during the T3 FSE. Governmental interaction with media outlets 
was tested through VNN Live; VNN.com; and notional radio, print, and other media 
outlets (press releases). Other means of reaching the public with official lifesaving 
information included the use of hotlines, call centers, agency website postings, e-mails, 
blast faxes, flyers, and reverse 911 to phones of citizens. NRP-related coordination 
structures and mechanisms used by FSL departments and agencies to develop and deliver 
messages to the public were examined. 

J. Observations 

• DHS demonstrated numerous tools that were implemented based on lessons 
learned from the T2 FSE and were designed to help coordinate a consistent 
message, including its Ready Room. National Incident Communications 
Conference Line (NICCL), and Public Affairs Guidance. 

• FSL departments and agencies may still not be prepared to provide swift, 
accurate, consistent lifesaving protective action guidance to the public. 

• The operations of multiple Joint Information Centers (JICs) were not always well 
coordinated, and a Joint Information System (JIS) was not used. 
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• DHS’ preexercise coordination with international participants may offer a model 
for international public affairs coordination in a terrorist attack. 

2. Recommendations 

Develop a supporting JIS CONOPS to complement emergency support function (ESF)'15 
and Public Affairs Annexes of the NRP and Incident Communications Emergency 
Response (ICER) to provide more specific operational implementation guidance for 
executing public affairs in the context of the NRP and NIMS. 

• Consider using future exercises to further test and refine protocols and educate 
stakeholder organizations on how mechanisms for public affairs coordination 
(e.g.. NICCL) can be used to promote a COP and coordinate message content. 

• Establish primary information sources early in the incident, such as the State 
hotlines and websites activated in New Jersey and Connecticut. 

VIII. Additional Issues 

A. State of New Jersey T3 Cyber Exercise 

The New Jersey T3 Cyber Exercise, a one-day interactive tabletop exercise, was 
conducted on March 30, 2005, at the Office of the Attorney General complex in Trenton. 
New Jersey. This exercise examined the integration of inter- and intragovernmental 
actions related to a large-scale cyber attack and synchronized with a terrorist WMD 
attack in an operational context. The exercise examined disruptions to networks, the 
consequences of those disruptions, responses, and the implications for protective 
measures. It was divided into the following three sessions: 

• Session I exercised a variety of communications paths and explored complex 
policy questions. New Jersey and Hudson County incident response 
capabilities and practices were examined. 

• Session 2 exercised the players’ ability to correlate information to determine 
complex attack vectors. Players examined their capability to identify 
remediation actions and potential unauthorized information exposure. 

• Session 3 exercised force multiplier effects and assessed their consequences. 
It included a major WMD event for State agencies and a power failure 
involving key county facilities and networks. 

1. Issues/Recommendations 

• Develop a leadership mechanism to provide oversight for New Jersey State 
cyber security and continuity of operations. 

• Develop a service agreement to define obligations and expectations of the 
provider and users, even though an Internet Service Provider resides within 
the broader State organization. 

• Conduct a statewide risk assessment of all IT-related capabilities. 
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• Create and distribute best practice documentation in areas such as 
configuration management, acceptable use, and incident response. 

• Draft a recovery plan to address the process, priorities, and any exceptions that 
may be required in the event of a takedown of the entire State network. 

• Establish and document a clearly defined threshold for reporting criminal 
intent or behavior to law enforcement. 

B. State of Connecticut T3 Cyber Exercise 

The Connecticut T3 Cyber Exercise was conducted on March 22-23, 2005, at the 
Connecticut Department of Information Technology headquarters in East Hartford, 
Connecticut. There were approximately 80 participants, including top officials and 
network operation centers (NOCs) from the Connecticut State Department of Information 
Technology, Connecticut Department of Transportation, Connecticut State Police, 
Connecticut Education Network, and City of New Haven. 

The NOCs used a simulated network developed by the Institute for Security Technology 
Studies (ISTS) as the primary source of exercise-related stimuli. The network replicated 
elements of regional, wide-area networks and an intergovernmental network. The 
exercise encompas.sed three cyber attack scenarios, each associated with different aspects 
of the cyber security problem: 

• Scenario 1, Disjointed Attacks, featured an “above normal” level of network 
disruptions. Players reviewed both the internal and external communication 
flows of their NOCs and discussed relevant cyber security issues. 

• Scenario 2. Coordinated Attack, was a low-level, coordinated cyber attack 
against stakeholder organizations. Players addressed response issues and 
identified the actions necessary to respond to these attacks in a combined 
manner and resume network operations. 

• Scenario 3, WMD Force Multiplier, was an overwhelming, coordinated cyber 
attack acting as a “force multiplier” for a combined terrorist WMD attack. 
NOCs addressed the neces.sary actions to reestablish or maintain network 
operations to permit crisis and consequence management. 

J. Issues/Recommendations 

• Connecticut or DHS needs to develop cyber-related plans and procedures 
associated with HSAS levels. 

• Network organizations and their functions, with regard to plans, policies, and 
procedures regarding cyber-terrorism within Connecticut, need to be 
identified. 

• Doctrine needs to reflect the importance of radio communications and non- 
voiceover Internet protocol (VoIP). 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

ES-16 





AAR 


TOPOFF 3 


C. Intelligence Play 

DHS made information sharing one of four key objectives in the T3 FSE. To ensure that 
information sharing was appropriately exercised, an Intelligence Working Group (IWG) 
was formed. The IWG defined and charted the real-world information-sharing channels 
that presently exist. This enabled T3 planners to create “preventable acts” that could be 
put into play through streams of intelligence for analysts to evaluate and intercede if the 
assessment dictated. 

The real-world intelligence is-sues noted during the exercise were primarily related to 
intelligence channels, disconnects, and other contentious or undefined areas in the 
intelligence community and information-sharing arena. 

J. Issues/Recommendations 

• Improve systems used to contribute to and create a common intelligence picture. 

• Develop further the validation of interagency processes for information sharing. 

• Create and maintain an Interagency Handbook for Information Sharing to enhance 
interoperability. 

• DHS should develop a detailed plan for the intelligence component and 
information flow under the NRP. 

• DDNI/Collection should form a Request for Information (RFI) working group to 
review processes, review systems, and provide recommendations for enhancing 
the visibility of RFIs and responses to RFIs between departments and agencies. 

o The establishment of an RFI fu.sion center at the National 
Counterterrorism Center (NCTC) should be considered. 

• Promote analysts’ awareness of and access to the span of interagency tools to 
"pull” intelligence. 

D. Private Sector Integration 

The National Strategy for Homeland Security states that the Federal government is 
responsible for fostering “unprecedented levels of cooperation” between the private 
sector and all levels of government. HSPD-5 emphasizes “the role that the private and 
nongovernmental sectors play in preventing, preparing for, responding to, and recovering 
from terrorist attacks, major disasters, and other emergencies.” 

Exercise design constraints were a limiting factor in private sector integration for T3. In 
addition to the stringent requirements placed on participating organizations, initial 
apprehension at the development of the private sector piece created a need for different 
levels of participation and a number of artificialities. The following issues were raised in 
the private sector portion of the exercise: 

• Prototype private sector coordination mechanisms: Two private sector 
coordinating mechanisms were prototyped during the T3 FSE: a Private Sector 
Liaison at the New Jersey and Connecticut Office of Emergency Management 
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(OEM), and a Private Sector Cell at the National Infrastructure Coordinating 
Center (NICC). As a result of the success of both models, players requested that 
the models be institutionalized for real-world incidents. 

• Public/private coordination and communication: The issues arising from the 
communication between the government and the private sector dominated the 
feedback from the private sector players. TTie issues surrounding the interfacing of 
public and private fell into three categories: (1) lines of communication, (2) 
method of communication, and (3) coordination. 

• Testing internal emergency response/business continuity plans: For the 
employees of many private sector organizations, T3 raised the level of awareness 
of the critical roles of business functions during an event. The cascading effects of 
absenteeism, especially of critical employees, can shut down organizations and 
subsectors. T3 also provided a useful, realistic opportunity for private sector 
organizations to test their internal response and business continuity plans. 

• Cross-sector coordination and communication: The T3 FSE illustrated that the 
current level of coordination and communication between various subsectors of 
the private sector is indispensable to an effective response, but also generally 
insufficient to respond effectively and efficiently to an event of this magnitude. 
The issue of creating an industry analog to the IIMG was offered, particularly as it 
relates to improving cross-sector integration for planning and evaluation. 

IX. Conclusion 

The T3 FSE was an innovative, challenging, and highly productive exercise designed to 
stress the system and the agencies responsible for responding to a terrorist attack. The 
observations, assessments, and recommendations in this summary were garnered from a 
number of forums and were validated from a practitioner’s standpoint. 

As the largest and most complex counterterrorism exercise ever attempted, the T3 FSE 
provided a tremendous opportunity for private sector and FSL governmental participants 
to test their procedures and push their agencies to their limits. Many departments and 
agencies were successful in stressing their policies and procedures and identifying 
potential shortfalls. In addition, the exercise provided many important lessons regarding 
FSL interagency procedures for communications and the integration of support measures. 

Because of the extensive data collection process and the effort to make T3 FSE findings 
well documented and traceable through a detailed reconstruction of the exercise events, 
the full AAR provides a baseline on which subsequent TOPOFF and other 
counterterrorism exercises can build and be rigorously compared. 
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Part 1: Exercise Overview 


Exercise Name: 

Top Officials (TOPOFF) 3 (T3) Full-Scale Exercise (FSE) 

Duration: 

T3 Planning and Relevant Events: June 2003-0ctober 2005 

Exercise Date: 

April 4-10, 2005 - Full-Scale Exercise 

Sponsor: 

Department of Homeland Security 

Federal Exercise Project Officer: 

DHS, Office of Grants and Training, Program Manager - Butch Colvin 

Type of Exercise: 

Full-Scale Exercise 

Funding Source: 

Department of Homeland Security 
Department of State 

Program: 

Homeland Security Exercise and Evaluation Program 

Focus: 

X Response X Recovery X Prevention 
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Classification: 

For Official Use Only f FOUO ) 

Scenario: 

Biological and Chemical Release 

Location: 

Washington, DC, New Jersey, Connecticut, Canada, and the United Kingdom 

Participating Organizations: 


Canadian Agencies 

Agriculture and Agri-Food Canada 

Canadian Border Services Agency 

Canadian Food Inspection Agency 

Canadian Security and Intelligence Service 

Citizenship and Immigration Canada 

Communications Security Establishment 

Department of National Defense 

Department of Justice 

Environment Canada 

Foreign Affairs Canada 

Fisheries and Oceans 

Health Canada/Public Health Agency of Canada 

Industry Canada 

Natural Resources Canada 

Public Safety and Emergency Preparedness 

Canada 

Royal Canadian Mounted Police 

Social Development Canada/Human Resources 
and Skills Development Canada 

Transport Canada 

Canadian Red Cross 

1 United Kingdom Agencies 

Cabinet Office 

Department for the Environment, Food and Rural 
Affairs 

Department of Health 
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Department for Transport (and TRANSEC) 1 

Foreien and Commonwealth Office 

Government Communications Headquarters 

Health Protection Agency 

Health and Safety Executive 

HM Treasury 

Home Office 

Joint Terrorism Analysis Centre 

National Health Service 

Ministry of Defense 

Office of the Deputy Prime Minister 

Office of Science and Technology 

Secret Intelligence Seryice 

Security Service 

Association of Chief Police Officers 

City of London Police 

Metropolitan Police 

United States Federal Agencies and Organizations 1 

American Red Cross (ARC) 

Bureau of Alcohol, Tobacco, Firearms, and 
Explosives (ATF) 

Centers for Disease Control and Prevention 
(CDC) 

Central Intelligence Agency (CIA) 

Department of Agriculture (USDA) 

Department of Commerce 

Department of Defense (DoD) 

Office of the Secretary of Defense 

U.S. Army Corps of Engineers 
USNORTHCOM 

National Security Agency (NSA) 

Department of Education 

Department of Energy (DOE) 

Department of Health and Human Services (HHS) 

Department of Homeland Security (DHS) 

Federal Emergency Management Agency 
(FEMA) 

Department of Housing and Urban Development 
(HUD) 

Department of Justice (DOJ) 

Department of Labor (DOL) 

Department of State (DOS) 

Department of the Interior (DOI) ; 
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Department of Transportation (DOT) 1 

Department of Treasury 

Department of Veteran’s Affairs (VA) 

Environmental Protection Agency (EPA) 

Federal Bureau of Investigation (FBI) 

Federal Aviation Administration (FAA) 

Food and Drug Administration (FDA) 

General Services Administration (GSA) 

Homeland Security Council (HSC) 

National Aeronautics & Space Administration 
(NASA) 

National Oceanic & Atmospheric Administration 
(NOAA) 

Nuclear Regulatory Commission 

Occupational Safety and Health Administration 
(OSHA) 

Office of Management and Budget (OMB) 

Small Business Administration (SBA) 

U.S. Postal Service (USPS) 

U.S. Marshals Service 

Non-Governmental Organizations 

American Red Cross of Central New Jersey 
Emergency Services 

The Salvation Army 

State and Local Agencies 

Kean University 

Middlesex County Office of Emergency 
Management - Emergency Services Center 

Middlesex County Office of the Fire Marshal - 
Emergency Services Center 

Middlesex County Prosecutor's Office 

New Jersey Board of Public Utilities - Bureau of 
Emergency Management 

New Jersey Department of Banking and Insurance 

New Jersey Department of Community Affairs 

New Jersey Department of Corrections 

New Jersey Department of Health and Senior 
Services 

New Jersey Department of Health and Senior 
Services - Emergenev Medical Services 

New Jersey Department of Health and Senior 
Services - Emergency Preparedness & Response 

New Jersey Department of Health and Senior 
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Services - Communications and Risk Information 

New Jersey Department of Human Services 

New Jersey Department of Labor 

New Jersey Department of Laws & Public Safety 
- Attorney General's Office 

New Jersey Department of Laws & Public Safety 
- Office of Counter-Terrorism 

New Jersey Department of Laws & Public Safety 
- Public Information 

New Jersey Department of Military and Veterans 
Affairs 

New Jersey Department of Transportation 

New Jersey Department of Treasury 

New Jersey Department of Environmental 
Protection 

New Jersey Division of Mental Health Services 

New Jersey National Guard 

New Jersey Network (NJN) 

New Jersey Office of Recovery and Victims 
Assistance (ORVA) 

New Jersey State Fire Coordinator 

New Jersey State Medical Examiner 

New Jersey Office of Emeraency Manaaement 

New Jersey State Police - Emergency 

Manaaement Section 

New Jersey State Police - Homeland Security 
Branch 

New Jersey Transit 

Port Authority of New York and New Jersey 

Rutaers University 

Union County Division of Emergency 

Manaaement 

Union County Health Department 

Union County Prosecutor's Office 

City of Groton Fire/Police 

City of New Haven Fire/Police 

City of Norwich Fire Department 

Connecticut Children’s Medical Center 

Connecticut Civil Air Patrol (CAP) 

Connecticut CT-1 Disaster Medical Assistance 
Team (DMAT) 

Connecticut Department of Corrections (DOC) 

Connecticut Department of Emergency 
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Manaaement and Homeland Security (DEMHS) 

Connecticut Department of Environmental 
Protection (DEP) 

Connecticut Department of Mental Health and 
Addiction Services (DMHAS) 

Connecticut Department of Public Safety 
(DPSVConnecticut State Police (CSP) 

Connecticut Department of Public Safety State 

Fire Marshall 

Connecticut Department of Transportation 

Connecticut DHS Immieration and Customs 

Connecticut Federal Bureau of Investigation 
(FBI) 

Connecticut Ledge Light Health District 

Connecticut National Guard 

Connecticut Occupational Safety and Health 
Administration (OSHA) 

Connecticut State Fire and Rescue Plan 

Connecticut Sub Base Fire Department 

Connecticut United States Coast Guard (USCG) 

Connecticut Urban Search and Rescue (US«&.R) 

Connecticut U.S. Customs and Border Protection 

Connecticut U.S. Department of Homeland 

Security Transportation Security Administration 

Mashantucket Pequot Tribal Nation Fire 

Moheean Tribal Government Fire/Police 

Montville 

Mystic Fire Department 

New London Fire/Police 

New London Health Department 

New London OEM 

Northem/Southem Tier Hospitals 

Pequonnock Bridge Fire Department 

Town of East Lyme Fire/Police 

Town of Groton ECC 

Town of Groton Police 

Town of Ledyard 

Town of Waterford Fire/Police 

UNCAS Health District 

University of Connecticut (UCONN) i 
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Number of Participants: 


• Participants 

• Controllers/Evaluators 

• Observers 


22 , 000 + 

1,700+ 

6004- 
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I. Exercise Overview 
A. T3 Authorization 

The Top Officials (TOPOFF) series of exercises is a Congressionally mandated, 
national counterterrorism progression of exercises designed to identify vulnerabilities 
in the nation’s domestic incident management capabilities. It actively exercises the 
plans, policies, procedures, systems, and facilities of Federal, State, and local (FSL) 
response organizations against a series of integrated terrorist threats and acts in 
separate locations in the United States. 

The TOPOFF exercise series’ authorization is anchored in Public Law 106-553. 
Senate Report 106-404 outlines the program conceptually. TOPOFF events also 
fulfill a requirement of the National Security Council’s Policy Coordinating 
Committee on Counterterrorism and National Preparedness Exercise Sub-group for 
the conduct of a large-scale, national-level, counterterrorism exercise. 

Whereas TOPOFF 3 (T3) planning began under earlier Presidential Directives, the 
Homeland Security Presidential Directive (HSPD)-5 articulates the current Federal 
incident management policy that ultimately provided focus for the exercise event and 
gave national impetus to the recently adopted and unrehearsed National Response 
Plan (NRP) and National Incident Management System (NIMS). In conjunction, 
HSPD-8 provides for the adoption of the following, all of which were incorporated 
into the T3 series of events: 

• National Preparedness Goal, National Planning Scenarios 

• Universal Task List 

• Target Capabilities List 

• Homeland Security Grant Program Guidance 

• National Preparedness Guidance 

All participating FSL, tribal, private sector, and international (United Kingdom and 
Canada) authorities were asked to submit exercise objectives to planners at the 
beginning of the T3 design cycle to ensure that the exercise would support specific 
participant objectives while also addressing national priorities. 
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B. Design and Concept 

The first TOPOFF exercise (TOPOFF 2000) was a single, no-notice, full-scale 
exercise (FSE) co-chaired by the Department of Justice (DOJ) and the Federal 
Emergency Management Agency (FEMA) in May 2000. TOPOFF 2 {T2) was 
designed as an open exercise in which participants were introduced to the scenario 
prior to the FSE through a cycle of activities of increasing complexity. T3 (co-chaired 
by DHS and DOS) was similar to T2 in architecture, although with a less scripted 
scenario. 

T3 was the largest and most comprehensive terrorism response exercise ever 
conducted in the United States. The exercise scenario, which was played out from 
April 4-8, 2005, depicted a fictitious, foreign terrorist organization that conducted a 
simulated chemical (mustard) attack and detonation of a vehicle-borne improvised 
explosive device (VBIED) in New London, Connecticut, and a release of pneumonic 
plague {Yersinia pestis) in Union and Middlesex Counties in New Jersey. There was 
also significant 30-day-intelligence play over real-world channels, two cyber 
exercises, and related terrorist exercise activities in the United Kingdom and Canada. 

The United Kingdom (ATLANTIC BLUE) and Canada (TRIPLE PLAY) conducted 
simultaneous, related exercises with overarching international exercise objectives to 
improve mutual response and preparedness against global terrorism. The three 
domestic scenarios were enhanced by incorporating events from the other two 
countries. The planning and execution of the three national exercises provided an 
excellent opportunity for international cooperation, networking of key responders, and 
sharing of information regarding each country’s concepts of emergency operations. 

T3 included the following seminars and exercises: 

• Command Post Exercise (CPX); 

• a series of planning conferences including: the Initial Planning Conference, 
Midterm Planning Conference, Final Planning Conference, and After-Action 
Conference (AAC); 

• a series of national seminars on chemical terrorism, biological terrorism, and 
public affairs; 

• an Advanced Distance Learning Exercise (ADLE); 

• a Senior Officials Exercise (SOE) Series (tabletops at the Deputy Secretary 
level); and 

• a Large-Scale Game (LSG) that focused on recovery and remediation 
requirements (tabletop three-day event series). 
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Exercise design, exercise play, and exercise review — the three major components of 
T3 — were all cast in deference to the four major objectives of the FSE: 

• Incident Management : To test the full range of existing procedures for 
domestic incident management of a weapons of mass destruction (WMD) 
terrorist event and to improve top officials’ capabilities to respond in 
partnership. 

• Intelligence/Investigation : To test the handling and flow of operational and 
time-critical intelligence between agencies in response to a linked terrorist 
incident. 

• Public Information : To practice the strategic coordination of media relations 
and public information issues in the context of a WMD terrorist incident. 

• Evaluation : To identify lessons learned and promote best practices. 

The purpose of designing an open and unscripted exercise was to enhance its learning and 
preparedness value through a building block approach, and to enable participants to 
develop and strengthen relationships in the national response community. Participants at 
the FSL levels endorsed this methodology as being very beneficial to the validation and 
coordination of their domestic preparedness strategies. 

C. Building Blocks 

The T3 FSE was the pinnacle of a series of building block events that occurred over the 
course of 18 months. Each event preceding the FSE and the one follow-on exercise were 
designed to build upon the stated goals and objectives established by all participating 
FSL departments and agencies. During each of these events, key leaders were brought 
together to identify and address issues pertaining to terrorism preparedness, response, and 
recovery. 

The relevant building blocks began with the National Seminar on Chemical Terrorism, 
conducted in Mystic, Connecticut, August 25-26, 2004. The seminar was designed to 
identify critical issues facing FSL, private sector, and international officials following a 
chemical terrorism attack. The seminar explored preparation strategies for the unique 
problems created by a chemical terrorism scenario and the best approaches to resolve 
these issues. The participants included representatives from domestic FSL governments, 
Canadian and United Kingdom governmental agencies, as well as State and local 
emergency response agencies from Connecticut and New Jersey. 

The National Seminar on Public Affairs was the second T3 national-level seminar, held 
in Silver Spring, Maryland, October 5-6, 2004. The seminar focused on the ability of the 
Federal government to coordinate messages across agencies through the NRP. Additional 
objectives of the seminar included: 

• balancing real-world and exercise media demands during the T3 FSE; 
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• maximi 2 ing the rehearsal value for participants of T3; and 

• examining/developing strategies to effectively communicate with the media and 
the public during a WMD event. 

This seminar was designed to reach Federal-level public affairs and public information 
professionals. 

The third seminar was held in the Meadowlands, New Jersey, December 1 -2, 2004. The 
T3 National Seminar on Biological Terrorism brought together homeland security leaders 
from FSL departments and agencies, as well as the Canadian and United Kingdom 
governments. The seminar offered the opportunity to discuss issues regarding the 
response to a bioterrorism attack. The event was designed to improve relationships and 
enhance networking between the FSL levels of government, the private sector, and 
international partners. 

The first local or venue-specific seminar was conducted in Union County, New Jersey, 
December 9, 2004. The New Jersey Seminar on Public Affairs explored the ability of 
New Jersey’s State public information officers (PlOs) to provide pertinent/timely 
information to the media and the general public during a large-scale health disaster. The 
one-day seminar provided New Jersey PlOs effective insight into risk communication 
management and recommended concepts necessary to prepare “public information” 
responses to a terrorist incident. The audience and program presenters were comprised of 
FSL government officials and public information professionals. 

The Connecticut Seminar on Public Affairs was the second locally-executed venue- 
specific seminar. It was conducted in Mystic, Connecticut, December 16, 2004. This 
seminar enabled Connecticut State PlOs an opportunity to discuss the policies, plans, and 
procedures in place to manage information and effectively communicate in the event of a 
major health incident. The seminar also addressed the issue of FSL partners working 
together to manage information during a major incident. The seminar was conducted over 
one day and included a public affairs training program designed by the U.S. Coast Guard 
(USCG) and a program comprised of a series of presentations on the different 
perspectives of risk communications. 

The third local seminar was held in Gloucester County, New Jersey, January 21, 2005, 
and dealt with chemical terrorism. This program explored the specific issues of response 
and recovery facing New Jersey in the event of a chemical terrorist attack. The goal of 
the seminar was to enable the target audience to make appropriate decisions during a 
chemical WMD attack utilizing NIMS principles. The seminar also provided education 
and training on information and intelligence sharing and increased awareness of the threat 
assessment process. During the one-day seminar, participants observed briefings and 
presentations and engaged in a facilitated scenario-based discussion. The participants 
included Federal government officials and New Jersey State and local emergency 
response agencies. 
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The final local seminar was held in New Haven, Connecticut, February 23, 2005, and 
dealt with “terrorism threat awareness.” The program provided background on the 
terrorist threat facing the United States and, more specifically, the State of Connecticut. 
The seminar also facilitated the exchange of information regarding the nature of the 
threat among the State and local agencies represented. One of the program’s principal 
aims was to enhance the knowledge and understanding of the current global terrorist 
threat, who the terrorists are, and how this background could be applied to homeland 
security training, exercises, and mission areas. Participants included representatives from 
Connecticut law enforcement, first responders, and private sector agencies. 

A Command and Control Seminar was conducted by means of the ADLE network, whieh 
aired via satellite broadcast, January 25-27, 2005. The seminar provided a forum for 
discussing control and consequence management of complex chemical or biological 
terrorist events. The ADLE was available to viewers after the satellite broadcast through 
the Lessons Learned Information Sharing website, as well as CD-ROM. 

The final T3 building block event was the T3 LSG. The LSG was conducted four weeks 
after completion of the FSE and addressed the nation’s ability to recover and manage the 
long-term consequences of a terrorist attack. The T3 LSG was designed based on the 
scenario, goals and objectives, and actual outcomes of the T3 FSE. The LSG foeused on 
the most pressing recovery issues, ranging from time periods of 30, 90, and 180 days 
post-incident. Representatives from all FSL government agencies and the private sector 
who participated in the FSE were included. 

To expose the Interagency with challenges they were likely to encounter during the FSE, 
two SOEs (tabletop exercises) were conducted. The principal objectives for the two SOEs 
included: 

• exercising the implementation of the Homeland Security Advisory System 
(HSAS), while identifying related protective measures for implementation and 

• identification of outstanding issues affecting the readiness posture of the U.S. 
government to manage complex WMD events. 

In addition, these exercises enabled participants to assess information and intelligence- 
sharing mechanisms and to identify the actions required to assure cohesive and 
appropriate domestic and international public notification. Both SOEs exercised top 
official decision making relative to an operational response in the context of the NRP and 
NIMS at a SECRET classification level. 

The first exercise, SOE 05-2, Fierce Squall, was held February 15, 2005, in Washington, 
D.C. Fierce Squall focused on the issues that senior-level officials would face in the 
wake of a biological terrorist attack. Participants were presented with the latest 
information and intelligence pertaining to biological WMD events and provided the 
opportunity to engage in discussion and decision making around this issue. 
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SOE 05-3, Roaring Tempest, was held March 10, 2005, in Washington, D.C. Roaring 
Tempest was conducted in three moves and addressed new intelligence, VBIEDs and 
chemical attacks, and expanding response/law enforcement security. 

II. Exercise Evaluation 

A. Evaluation Methodology 

The evaluation of the T3 FSE aims to: 

• assess and enhance FSL terrorism preparation, prevention, and response 
capabilities; 

• provide objective observations of complex, multifaceted interactions of FSL 
entities; 

• provide recommendations for improving FSL counterterrorism incident 
management policies and procedures; and 

• provide a basis for assessing progress and improvement over time and against 
the backdrop of evolving policies and procedures. 

The T3 FSE evaluation focuses on high-level FSL coordination, support plans, policies, 
and procedures. In addition to the evaluation presented in this document, organizations 
that participated in the exercise were encouraged to conduct their own internal 
evaluations based on their specific objectives, tasks, and procedures. 

The following people and elements collected data for the T3 FSE evaluation: 

• Data collectors: Data collectors were provided by participating agencies to 
record what happened in a particular place or among a particular group of 
participants. They were knowledgeable about the activities of the players they 
observed (e.g., firefighter data collectors observed firefighter players). In 
many instances, the participating agencies also used these data to conduct 
their own internal evaluations. 

• Analysts: Analysts were provided by the exercise support team and were 
responsible for the oversight and coordination of all aspects of data collection 
and evaluation. After the exercise, the analysts conducted the reconstruction 
and analysis in accordance with the evaluation methodology discussed in this 
document. 

• Lead Analyst: The lead analyst reconstructed and analyzed the T3 FSE and 
wrote the reconstruction and analysis sections of the T3 FSE After-Action 
Report (AAR). 

• Players: Players were FSL agency and department personnel who had active 
roles in the response. They performed their assigned roles and functions in 
response to the situations in the exercise. Players initiated actions that 
managed and mitigated the simulated emergencies. 
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• Controllers: Controllers, using procedures identified in the control staff 
instructions (COSIN), managed the conduct of the exercise; directed the pace 
and intensity of exercise play; assured the safety of participants, the public, 
and the environment; and maintained the security of exercise participants, 
equipment, and resources. Controllers monitored the sequence of exercise 
events and the pace of activity. In many cases, controllers were drawn from 
the trusted agents who planned the exercise. 

• Simulators: Simulators, including actors and role players, were control staff 
personnel who simulated nonparticipating organizations or role-played key 
nonparticipating individuals. 

• Master Scenario Events List (MSEL): The T3 FSE MSEL was the primary 
exercise control document. It is the chronological list of exercise injects and 
event implementers that was used to stimulate and guide player action. Each 
MSEL inject or implementer specified when, by whom, to whom, and what 
was injected. 

• Virtual News Network (VNN): VNN was a mock media production group that 
supplemented the MSEL. As would be expected during an actual terrorist 
event, players received public media injects and interactions over VNN. 

B. T3 Evaluation Methodology 

The T3 FSE evaluation methodology is based on the approach outlined in HSEEP 
Volume 11: Exercise Evaluation and Improvement. The overall aim of the evaluation is to 
document what happened during the exercise and explain h7jv. This methodology 
provides participants and response agencies with information they can use to improve 
their response policies and procedures regarding incidents of national significance. The 
analysis also provides information for organizations conducting their internal evaluations. 
Evaluation consists of the following three steps: 

1 . Observation: Collecting data 

2. Reconstruction: Determining what happened and when 

3. Analysis: Determining why specific actions or events occurred 

/. Observation 

To record what happened in the exercise, dedicated observers known as data collectors 
were assigned to sites of exercise play. The scale or intensity of play, number of players, 
and geographic spread of the location determined how many data collectors were present 
at a given site. Analysts supplemented data collectors at key exercise sites, such as State 
emergency operations centers or Joint Field Offices (JFOs). 
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Data collectors were not the only observers who provided data for analysis. Players, 
controllers, simulation cell (SIMCELL) staff, and VNN also contributed critical data to 
the analysis. Players provided data by: 

• Completing questionnaires (player feedback forms); 

• Providing copies of logs, e-mails, and other documentation developed during 
the T3 FSE; 

• Contributing to their organization’s lessons learned; and 

• Contributing to Hotwashes. 

This input was critical to the analysis, as it represents players’ perspectives on the 
exercise and their actions/decisions. Exercise support personnel provided controller logs, 
SIMCELL logs, and VNN reports to the analysts. 

In addition to data collected during the T3 FSE, a Hotwash and AAC results were 
collected to obtain additional player feedback and the most complete understanding of the 
critical aspects of the exercise. 

2. Reconstruction 

Reconstruction produces a fact-based, time-synchronized, de-conflicted, and meaningful 
account of what happened in the exercise. This laborious process is essential for 
conducting a meaningful analysis. Reconstruction involves the following: 

• independent and parallel reconstruction of events at each location by analysts 
assigned to one or more locations; 

• group reconstruction of how the events at each location fit in with those at the 
other locations (this step typically engenders considerable revision of the 
individual analyst’s initial reconstruction of events at his/her location); and 

• creation of a single reconstruction report. 

The T3 FSE reconstruction report was completed before this AAR. An abridged version 
of the complete T3 FSE reconstruction is provided in this report. 

3. Analysis 

In this final step of the evaluation process, the analysts use the record of events provided 
by the reconstruction to objectively seek patterns and develop an understanding of why 
certain issues emerged during the exercise. The analysis of these issues includes detailed 
descriptions of the issues and, when relevant, potential explanations for the behavior or 
result. The T3 FSE analysis also identifies areas for improvement and recommends 
courses of action that are intended to strengthen the ability of FSL organizations to 
respond to emergencies. FSL agencies should take these results and use them to develop 
improvement plans. 
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III. Exercise Reconstruction 

The reconstruction provides a timeline of the T3 FSE. The timeline is an overview of the 
events and activities that took place during the exercise. The T3 FSE reconstruction 
product is the result of reviewing the observations in nearly 400 data collector logbooks. 
These observations were augmented with controller observations and chat logs from the 
Master Control Cell (MCC) and Venue Control Cells (VCCs). Player-generated data, 
including more than 2,000 e-mails, briefs, website postings, and notes, were also used. 
These data sources were compiled into a database with more than 10,000 data entries. 
The database was then sorted by time, taking into account each venue’s specific time 
zone. Decisions and events were identified and filtered for redundancy. 

It is important to distinguish between events that were physically executed and those that 
were notional. The physical activities involved the participation of: 

• top officials and representatives of top officials; 

• participating agencies’ personnel numbering in the thousands; 

• more than 400 “injured” persons in Connecticut, represented by role players and 
augmented by a few mannequins and on-paper patients; 

• thousands of role players acting as NJ patients augmented by on-paper patients 
and the public at the points of distribution (PODs); and 

• VNN broadcasts. 

Although these parties’ actions were affected to some degree by exercise artificialities, 
they were real in the exercise sense that somebody physically participated and performed 
the action, thereby encountering some semblance of realistic time delays, possibility of 
errors, and the issues that real operations entail. 

All other actions — the closures of highways, airports, and ferry systems; orders to the 
population to shelter-in-place; elevations of the HSAS threat condition; spread of 
pneumonic plague outside New Jersey, etc. — were done in a notional sense. Also, all 
requests for emergency powers, changes of alert status, and so on were granted only on 
an exercise basis. 

What follows is a reconstruction summary in a tabular format to lend context to the 
analysis. The table enables the reader to compare the events of one venue with the events 
of the other venues. Specific times are indicated based upon the data. They are provided 
not for the purpose of pinning events or decisions down to the exact minute, because the 
vast volume of data and multiple observer/participant accounts do not allow for such 
precision. These times illustrate the overall sequenee of key events and decisions. The 
definitions of acronyms are provided in the Acronym List in this AAR. 

A more complete, searchable full reconstruction product is provided separately. The full 
reconstruction enables readers to understand exactly what happened during the T3 FSE 
and, more importantly, what types of activities and decisions one could expect to 
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encounter in a chemical weapon or bioterrorism attack. It takes into account the various 
perspectives of participants and all government levels. 
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Table 1. T3 FSE Summary Reconstruction 


D-Day, Monday, April 4 


Tlme 

NEW JERSEY 

CONNECTICUT 

Interagency and Foreign 

08:00-09:00 

EDT 

Symptomatic patients 
presented to hospitals in 

NJ, 

SUV discovered at Kean 
University. 



09:00-10:00 

EDT 

i 

, Scene around SUV at 

Kean University was 
secured by law 
enforcement officials. 


UK considered raising its 
assessment of the threat in the 
U.S. from “severe" to 
“critical.” 

10:00-11:00 

EDT 

Cases of presumptive 
diagnoses of plague were 
reported. 


CDC put out a heightened 
epidemiological alert. 

USCG boarding of M/V Red 
Thunder was completed. 

1 1:00-12:00 
EDT 

FBI received preliminary 
results of positive plague 
test on SUV. 

Airborne chemical was 
released over New London 

Pier in CT. 

Interagency Incident 
Management Group (IIMG) 
Director convened an 
emergency Counterterrorism 
Security Group (CSG) 
teleconference. 

Homeland Security 

Operations Center (HSOC) 
Public Affairs Office (PAO) 
activated the NICCL. 

UK increased its assessment 
of the threat level in the U.S. 
to “critical." 

1 VNN reported a large number of patients with “fiu-like’’ symptoms reporting to NJ 

1 hospitals. 

12:00-13:00 

EDT 

NJ Governor declared a 
state of emergency. 

\ initiated the activation of 
' the Emergency Operations 
; Center (EOC), and raised 
the State’s threat condition 
■ level to Orange. 


Secretary of Homeland 

Security activated the IIMG. 

13:00-14:00 

EDT 

1 

1 

VBIED attack occurred in 

New London, CT. 

New London Fire Chief 

1 arrived on scene and 
assumed Incident Command. 

Interagency Modeling and 
Atmospheric Assessment 
Center (IMAAC) was 
activated by HSOC. 
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Time 

New jersey 

CONNECTICUT 

Interagency and Foreign 

14:00-15:00 

EDT 


CT Governor declared a state 
of emergency, activated the 
State EOC, and raised the 
State’s threat condition level 
to Orange. 

FBI Special Agent-in-Charge 
(SAC) requested support 
from the Domestic 

Emergency Support Team 
(DEST). 

CT State Police advised the 
public to shelter-in-place. 

FBI reported that a private 
citizen observed a suspicious 
airplane land at a private 
airstrip one mile from 

Deblois, ME. Four unknown 
subjects left the airfield in a 
blue late-model Ford 500. 

The Secretary of Homeland 
Security declared the events 
in New Jersey to be an 

Incident of National 
Significance (INS) and 
designated a Principal 

Federal Official (PFO). 

Nice was activated via 
Emergency Notification 
System. 

15:00-16:00 

EDT 

Epidemiological Team 
from U.S. Public Health 
Service arrived at NJ 

DHSS. 

There was a presumptive 
confirmation of mustard gas. 

DMAT was assembled at 
Camp Rcll. 

Fisher’s Island Sound Ferry 
informed USCG that ferry 
services were shut down and 
residents of Fisher's Island 
Sound were shcltering-in- 
place. 

CT Governor requested a 
declaration under the 

Stafford Act. 

Secretary of HHS authorized 
the deployment of Strategic 
National Stockpile (SNS) to 

NJ. 

Secretary of Homeland 

Security declared the 
incidents in CT to be an INS 
and designated a PFO. 

Driver of a suspicious vehicle 
was detained by the Canadian 
Border Services Agency. 

Three men escaped. 

16:00-17:00 

EDT 

1 NJ requested DMATs, 
Disaster Mortuary 
Operational Response 

Teams (DMORTs), and 
CDC epidemiologists. 

FBI reported that the Joint 
Operations Center (JOC) 
designated the New London 
incidents as terrorist attacks. 

Unified Command (UC) 
formally stood up. 

The CT National Guard (NG) 
arrived at the Waterford 

Police Department (PD) for 
assignment to the Millstone 
Nuclear Power Plant. 

UK issued travel advisory for 
the U.S. 


Secretary of Homeland Security raised HSAS level to Orange for the nation and to Red in 
Middlesex and Union Counties, NJ. 

The President verbally issued Stafford Act declarations for CT and NJ. 
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Time 

New jersey 

CONNECTICUT 

Interagency and Foreign 

17:00-18:00 

EDT 

PFO requested 10 DMATs 
and 3 DMORTS on alert in 
support of NJ. 

CDC-SNS Technical 
Advisory Response Unit 
(TARU) was deployed to 

NJ. 

CT Department of Public 
Health (DPH) requested the 
CDC Rapid Response 

Registry. 

Federal Coordinating Officer 

1 (FCO) arrived at the JFO. 

JFO is activated. 

' CT State DMAT arrived at 
the incident site. 

Secretary of HHS declared a 
public health emergency in 

NJ. 

Royal Canadian Mounted 
Police (RCMP) stopped 
vehicle with four suspects: 
one was in custody, and three 
remained at-large. Suspect 
admitted involvement in CT 
incident. 


AMTRAK closed passenger 

rail service between Washington, D.C. and Boston. 

18:00-19:00 

EDT 

Elizabethtown Water 
Company advised 
consumers to boil water 
before use. 

All county EOCs in NJ are 
asked to activate. 

Preliminary case 
definitions for plague were 
issued. 

EPA requested TAGA. 

HHS SERT arrived at the 
, JFO. 

National Response 
Coordination Center (NRCC) 
received CT and NJ 
Governor's requests for 
Stafford Act declarations. 

19:00-20:00 

EDT 

NJ EOC informed that 

SNS is arriving and needs 
an escort. 

ARC stopped all blood 

1 collections in NJ. All 
blood collected in NJ and 

PA within the past three 
weeks was quarantined. 

ATF National Response 

Team (NRT) was activated 
for response to the New 

London incident. 

HHS requested 1,000 
ventilators for New London 
incident site. 

20:00-24:00 

EDT 

, NJ State Medical 

1 Examiner reported 92 
deaths to the NJ State 

EOC. 

SNS Ml arrived at NJ 
Receipt, Staging, and 

Storage (RSS) site. 

UC turned over incident site 
to FBI and moved to UCP. 

CT NG Civil Support Team 
(CST) field tests showed 
positive results for mustard. 

Unified Command (UC) held 
planning meeting for Incident 

1 Action Plan (lAP). 

NRCC confirmed a major 
disaster declaration in CT 
and an emergency 
declaration in NJ. 
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D+1. Tuesday, April 5 


Time 

New jersey 

CONNECTICl'T 

INTER.\GENCY AND FOREIGN 

24:00-03:00 

EDT 

SNS push package arrived at 

NJ RSS site. 

FEMA informed NJ State 

EOC that DMORT will arrive 
in state at 06:00. 

SNS ventilators ( 1 ,000) and 
bum/blast kits (1,000) arrived 
at USCG Station in New 

London. 

CDC reported a total of 36 
suspected plague cases in 1 6 states 
and Washington, D.C. 

IMAAC reported that, based on a 
comparison of field tests with 
models, sulfur mustard dispersal 
was both via VBIED and airborne. 

03:00-06:00 

EDT 

NJ NG activated. 


VBC News reported multiple 
patients in UK hospitals with flu- 
like symptoms. 

UK Foreign and Commonwealth 
Office a.skcd if consular officials 
could access sites in NJ and CT. 

06:00-08:00 

EDT 


UC approved the lAP. 

PFO and JFO approved 
incident site sampling plan. 

USCG raised Maritime Security 
(MARSEC) level in Port of 

NY/NJ to MARSEC 11. 

08:00-09:00 

EDT 

First request for medical 
support to a POD was 
received by the RSS 
warehouse lead. 

FBI reported that chemical 
precursors to mustard gas were 
found on MA' Red Thunder. 

ECA laboratory confirmed 
presence of mustard. 


09:00-10:00 

EDT 

FEMA Region 11 submitted 
formal request for Defense 
Coordinating Officer (DCO) 
to DoD. 

State RSS shipped 
medications to Union and 
Monmouth Counties. 

CT State EOC requested DoD 
Quick Reaction Force (QRF) 
to replace CT NG at Millstone 
Nuclear Power Plant. 

CT Department of Public 

Health (DPH) reported 195 
fatalities. 4,130 sick/injured, 
and 8,987 worried well. 

FBI requested to conduct 
interviews of the three arrested by 
RCMP. 

UK Cabinet Office Briefing Room 
(COBR) decided to go to “criticar' 
in the UK. 

10:00-11:00 

EDT 

Union and Middlesex Counties 
schools were closed. 

FBI Hazardous Materials 
Response Team (HMRT) 
conducted chemical analysis of 
S5-gallon drum found on small 
aircraft. Tests were positive for 
mustard gas. 

HHS contacted World Health 
Organization (WHO) to discuss 
implications of the plague 
outbreak. 

11:00-12:00 

EDT 

State RSS shipped 
medications to Mercer 

County. 

The highway Information 
Sharing and Analysis Center 
(ISAC) issued an advisory to 
all carriers who have been in 

CT within the past 36 hours. 

HHS asked VA to alert all 
hospitals and clinics in NJ and CT 
to be prepared to take in patients 
and to use VA facilities as staging 
areas for Federal assets. 

VNN reported that the President had issued a Statement of Concern. 
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Tlme 

New jersey 

CONNECTICUT 

Inter,\gency and Foreign 

12:00-13:00 

EDT 

First real POD opened (Union 
County). 

ARC opened a temporary 
shelter in Groton, CT. 

VNN reports that cruise ship 
passengers from NJ were not 
screened for plague as they 
disembarked at Port St. John. 

FBI reported that a source reports 
that a shipment of weapons and 
ammunition is hidden in a car 
being shipped to the U.S. onboard 
the M/V Black Cloud. 

13:00-14:00 

EDT 


New London City Manager 
closed the New London EOC. 

FAA announced that international 
flights inbound to JFK and EWR 
would be diverted to BOS. BWI, 
and PHL airports. 

14:00-15:00 

EDT 

NJ Governor raised threat 
condition to Red for entire 
State. 

EPA and CT Department of 
Environmental Protection 
(DEP) implemented sampling 
and monitoring plan. 

NRCC received request from HHS 
to set up 2 alternative care 
facilities, one in each state. 

C/S Comet Atlantic arrived in 
Halifax and was quarantined by 
Public Health Canada. 

15:00-16:00 

EDT 



DOS reported that British consular 
officials granted permission to 
: visit NJ and CT. 

16:00-17:00 

EDT 



Report of first case of Y. pestis in 
Fredericton, New Brunswick, 
Canada. 

17:00-18:00 

EDT 

NJ Governor announced plan 
for distribution of prophylaxis 
to all Slate residents. 

Administrative Order issued 
closing all schools and 
colleges in the Slate 

FBI identified the location of 
a safehouse and laboratory 
related to NJ biological 
attack. 

CT OEM requested ARC 
feeding and mental health 
support for 10.000-bed ACF. 

FBI reported USCG tracking 
M/V Black Cloud off 

Nantucket, which may have 
mustard gas onboard. 

DHS and HHS requested ESF-13 
to identify security requirements 
for ACF in NJ and CT. 

18:00-19:00 

EDT 



Secretary of Homeland Security 
raised HSAS level to Red for 
entire State ofNJ. 
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Tlme 

New jersey 

CONNECTICUT 

Inter.\gency and Foreign 

19:00-24:00 

EDT 


FBI turned incident site over to 
EPA. 

CT Governor asked President 
for QRF. 

Secretary of HHS approved 
Emergency Use Authorization 
(EUA) for ciprofloxacin, and FDA 
approved the protocol. 

HHS announced combined 

Federal and State POD plan. 
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D+2, Wednesday, April 6 


Time 

New JERSEY 1 

CONNECTICUT 

Intera(;ency and Forekin 

01:00- 

09:00 

EDT 

Expanded NJ State PODs 
(notional) and Federal PODs 
(notional) opened (08:00). 

New Jersey State Police 
(NJSP) and FBI teams 
initiated assault on 
safehouse and bio lab. 

QRF arrived at Groton 
airport to conduct relief-in- 
place with CT NG at 

Millstone Power Plant. 

Bomb exploded in London, 

UK financial district. Blister 
and nerve agents potentially 
involved (09:00 BST). 

09:00- 

11:00 

EDT 

VNN reported that a 
temporary morgue planned 
for 5,000 to 10,000 deaths. 


HHS confirmed plague 
deaths in 26 states, mostly 
near NJ. This report was 
consistent with a single POD. 

DOS reported 120 injured 
and 58 deaths in the UK (18 
U.S. citizens injured and 4 

U.S. citizens dead). 

RCMP located a safehouse. 
Situation was escalated to an 
armed encounter with three 
hostages being taken. 

11:00- 

13:00 

EDT 

1 

Officials in State EOC 
decided to lift travel 
restrictions. 

Sampling results confirmed 
no further contamination to 
the west and significant 
degradation due to rain 
overnight. 

NRT agreed to provide a 
panel of technical experts to 
advise the UC on a plan to 
decontaminate facilities. 



NJDA submitted request for 

2 Veterinarian Medical 
Assistance Teams 
(VMATs). 

NJ State EOC advised NJSP 
of decision to lift travel 
restrictions and to dissolve 
checkpoints at the State 
borders. 

DOJ approved a search 
warrant for MA^ Black 

Cloud. 

EPA and CT DEP concluded 
sampling efforts at the 
incident site. 

UK Prime Minister made 
public statement that another 
attack on UK was imminent. 
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Time 


New JERSEY 


CONNECTICUT 


Interacency and Foreign 


15:00- 

17:00 

EDT 

SERT reported a notional 

POD throughput of 

1,044,750. 

VNN reported 6,508 dead in 
NJ, 

Money allotted for 
refrigerated trucks changes | 
from $500,000 to $5 million. 
Trucks cannot be rented i 

because once they are 
contaminated they cannot be ■ 
used for food again. 1 

Notional Federal POD 
prophylaxis throughput is 
estimated at 1.194,000. ! 

CT Governor lifted shelter- 
in-place order. 

FBI conducted raid on 
suspected safehouse in CT. 
Two subjects were taken into 
custody. 

DHS Science and 

Technology (S&T) reviewed 
recommendations for 
deployment of BioWatch 
detectors to new additional 
Jurisdictions. 

RCMP prepared to board 

M/V Castle Maine, which is 
suspected to have mustard 
gas onboard. 

VA responded to requests 
from HHS to locate 7 VA 
clinic sites for PODs and 
provide RNs. LPNs. and 
physicians for ACF. 

17:00- 

20:00 

EDT 

NJ State EOC reported that ' 
456 notional PODs were in 
operation. 

CT Secretary of State sent a 
letter to HHS Secretary’s 
Operation Center (SOC) 
declining 5,000-bed ACF. 



Law enforcement reported 
the theft of four ambulances 
from four hospitals. 

FBI Hostage Rescue Team 
(HRT) assaulted the MA/ 
Black Cloud. 
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D+3, Thursday, April 7 


Time 

New jersey 

CONNECTICUT 

I\TERAt;E.NCY AND FOREICN 

24:00- 
08:00 EDT 

Total number of deaths 
reported as 8,070. 

Emergency Medical Services 
(EMS) units arrived at two 
staging areas, the 
Meadowlands Sport 

Complex and the PNC Arts 
Center for Operation Exodus. 



08:00- 
10:00 EDT 

JFO received the Emergency 
Declaration amended to 
include 10 additional 
counties. 

A total of 66 

EMS/ambulances units were 
dispatched to hospitals. 



10:00- 
12:00 EDT 

Cl 30 for Operation Exodus 
arrived at Newark Liberty 
International Airport (NLIA). 

Patients were transported 
from hospitals to NLIA. 



12:00- 
15:00 EDT 

Federal PODs closed. 

The transfer of patients from 
ambulances to the C-130 
begins. 

Operation Exodus concludes. 

NJ Governor announced 
opening of 20 notional 
family a.ssislancc centers. 


Bomb exploded at Waterloo 
Station, London, UK. 

HHS, Immigration and 
Customs Enforcement 
(ICE), and FBI worked to 
locate and transport injured 
UK citizens out of the 
country. 

15:00- 
18:00 EDT 

NJ requested that individual 
assistance be added to the 
emergency declaration. 


CDC reported 4,600 plague 
cases and 2,000 deaths in 
states outside NJ. 

One American is dead and 
two were injured in 

Waterloo explosion. 

18:00- 
21:00 EDT 

FEMA Region 11 Regional 
Response Coordination 

Center (RRCC) received 
letter from NJ Governor 
requesting the emergency 
declaration to be changed to 
a major disaster declaration. 
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Time 


New jersey 


CONNECTICUT 


Interagency and Foreign 


21:00- 

NJ State PODs closed 


Copy of FDA EUA for 

24:00 EDT 

(23:00). 


ciprofloxacin was signed 




and sent to SERT in NJ. 


D+4, Friday, April 8 


Time 

New jersey 

CONNECTICUT 

Interagency and Foreign 

24:00- 
09:00 EDT 



UK reported nine confirmed 
plague cases (three dead). 

RCMP boarded M/V Castle 
Maine. 

09:00- 

ENDEX 

EDT 

VNN reported 8.8 million 

NJ residents received 
prophylaxis. 


CDC reported 600 deaths 
from reactions to 
doxycycline, 200 deaths 
from reactions to 
ciprofloxacin. 

Transition back to HSAS Orange level in NJ. Remainder of country remains at Orange. 
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IV. Exercise Artificialities 

By their nature, exercises are not real events, and no exercise can duplicate the scope and 
richness of real-world emergencies. Although every attempt is made to mitigate their 
effects, artificialities will occur and can affect the outcomes of the exercise. If the nature 
and effects of artificialities are not taken into account, the conclusions drawn from the 
exercise could be incorrect. This section focuses on the key artificialities noted during the 
exercise. These artificialities can be placed into the following broad categories; 

• those that are inherent to the exercise design process; 

• those specifically related to the T3 exercise design; and 

• those that arose during actual exercise play. 

The net impact of artificialities can be difficult to assess. For example, considerations 
must be taken into account for questions such as the following: 

• Did an artificiality make the response decisions or actions easier than they might 
have been? 

• Did an artificiality unnecessarily complicate the response relative to a real-world 
operation? 

For their part, the T3 exercise designers tried to strike a balance, compensating for one 
artificiality (e.g., a response team’s need, absent a real-world emergency, to take a 
commercial flight) with another (e.g., the same team’s seemingly premature departure). 

The two questions to ask when assessing the impact of an exercise artificiality are: 

• What difference, if any, did it make to the play of the participants? 

• What difference, if any, did it make to the play of top officials? 

A. Artificialities Inherent in Exercise Design 

There will be artificialities in any exercise involving the response to a WMD event. The 
fundamental issue is that it is often impossible to exercise the full scope of a real-world 
event — ranging from an actual bomb detonation to shutting down transportation 
infrastructure to commanding the full-time attention of top officials. Many exercise 
events or actions must be notional or simulated, instead of actual. Despite the notional 
character of some events, governmental agencies and organizations played as though the 
events actually took place. This allowed the T3 evaluation team to examine decision- 
making, coordination, and communication issues. As long as they are understood and 
accounted for in the analysis process, the T3 FSE artificialities should not have a 
significant impact on interpreting the results of the exercise. 
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}. Top Officials' Play 

The involvement of top officials in T3 was extensive but in real-world emergencies of the 
magnitude portrayed in this exercise they would be immersed in coping with the 
emergency, almost to the exclusion of all other activities. In T3, top officials were present 
only intermittently and largely on a schedule; however, they devoted considerable 
personal time to the exercise. Some also designated individuals (e.g., a deputy) to play 
their parts in the exercise when they were not available. The T3 evaluation team believes 
that top official play during the exercise was relatively unaffected by the artificialities of 
scheduling, availability, and substitution. 

2. Limited Scope of Play 

Many effects associated with the intentional release of Yersinia pestis and a sulfur 
mustard agent were not designed into or played in the exercise. Some of the most 
important include the following: 

• exercise play was expanded to include the effects of the releases on states other 
than Connecticut and New Jersey and 

• the potential for population disruption, movement, anxiety, and fear. 

3. Notional Actions 

Because of limits on the scope of play, the most apparent artificialities were those in 
which notional (or constructive) actions replaced real ones. Examples include the 
notional closure of New Jersey borders and roads and the activation of hundreds of 
notional PODs. 

4. Limited Public Involvement 

In a real-world event, the public reaction can include clamor for more information, 
crowds of people fleeing their homes, traffic jams, and disruptive reactions during the 
public appearances of top officials. Although T3 involved role players acting as patients 
in New Jersey hospitals and PODs and as persons injured by victims of the blast in 
Connecticut, the general public was minimally represented. There was no reaction to the 
emergency from the general public. These reactions could have impacted top officials’ 
decision making and the actions of emergency personnel at the scene; however, 
precluding their existence was a necessary artificiality. 
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Many important considerations would include, but not be limited to, those regarding 
public information, heightened public anxiety, and other psychosocial factors. Such 
issues would expand beyond the immediate affected communities. For example, other 
cities in America that were not coping with the ongoing emergency would look for 
guidance regarding what might later happen in their cities. The lack of involvement from 
48 non-affected states and hundreds of non-affected cities is an artificiality that must be 
taken into account when considering the play of national top officials. 

B. Artificialities Specific to the T3 Design Process 

The artificialities in this section represent deliberate choices made during the design of 
T3 or they are specific to this particular exercise. These choices were made with the 
understanding that they would impact exercise findings. The T3 evaluation team believes 
that these impacts are accounted for in the exercise analysis. 

/. Knowledge of the Scenario 

T3 was designed as a building-block process wherein the general exercise scenario was 
explored in a series of seminars, an LSG, and SOEs. This process was designed to 
promote learning among the agencies and organizations involved in T3. Indeed, 
participants felt that they had learned a great deal even before participating in the FSE. It 
is important to note, however, that while the scenario was widely known, participants did 
not have access to the MSEL, which drove FSE play. 

2. Scope of Participation 

A number of important organizations and governments were simulated. Notable 
examples included the governments of France, Singapore, and Thailand, as well as the 
real-world media. Additionally, private sector participation was limited. The governments 
of Canada and the United Kingdom did participate in the T3 FSE; however, their 
participation was based upon Command Post Exercises (CPXs). 

3. Spread of the Pneumonic Plague 

During the planning of the exercise, the decision was made not to address the spread of 
plague outside the borders of New Jersey. Although numbers of plague victims were 
reported in other states, officials from those states did not simulate the action of 
requesting assistance (e.g., access to the Strategic National Stockpile (SNS)). In a real- 
world outbreak of plague, the Federal government would have taken the needs of these 
states into account when deciding how to support New Jersey’s needs, potentially 
limiting New Jersey’s access to Federal resources. 
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4. Lack of 24-Hour Ploy 

In a real-world emergency, activity would have continued around the clock. During the 
T3 FSE, some activities functioned around the clock, but others did not. As a result, some 
participants were occasionally stymied when other participants were not playing at the 
same time. For example, “overtime” costs limited play commitment from some 
participants. 

5. Prepositioning of Responders 

Various assets, such as teams from the DHHS, DoD, FEMA, and the FBI were 
prepositioned in the venues for reasons of safety, logistics, and cost. The T3 evaluation 
accounted for advance deployments and ensured that they were accounted for in the 
subsequent analysis. 6. Varying Participation Schedules 

Numerous city, county, and State agencies participated in the T3 FSE at different times 
during exercise play. For example, the 90+ hospitals participating in New Jersey operated 
during different time periods. As a result, some activities that would usually occur in a 
coordinated fashion were disjointed. This resulted in organizations operating under 
different conditions (e.g., some during the early phase of the disease outbreak and others 
later), thereby creating some degree of confusion. 

Similarly, the PODs that distributed prophylaxis in New Jersey operated on a staggered 
schedule. Each POD operated for approximately four hours on different days during the 
exercises. 

C. Artincialities Arising during Exercise Play 

A number of artificialities arose during the execution of the exercise. In an exercise as 
large and complex as T3, this is not an unexpected event. These artificialities were 
properly accounted for in the analysis of the exercise. 

I. Flooding in New Jersey 

In the days prior to the exercise. New Jersey experienced heavy rains that caused 
significant flooding. At times, participants had to suspend their participation in the 
exercise to respond to the real-world flooding emergency. The flooding also impacted the 
location of some of the State facilities in Trenton, causing minor disruptions. These 
incidents are accounted for in the analysis. 
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2. Issues with Control 

During the T3 FSE, there were several minor incidents in which controllers took it upon 
themselves to modify the scenario. There were also instances in which other exercises or 
unrelated events were briefly believed to be part of T3 play. 

In other instances, controllers provided players with information that the players should 
have been required to obtain through their participation in the exercise. Many players in 
the infrastructure that support top officials and their PIO staff were uneertain about how 
to interact in the exercise. In some cases, they requested information from controllers that 
they were not able to easily obtain through their formal channels. This contributed to a 
number of conflicting information threads which were fed to top officials, spokespersons, 
and press releases and were challenged by the VNN Live anchors during interviews. 
Again, these instances were documented and accounted for in the analysis. 

3. Notional Play 

There is evidence that some participants did not understand the concept of “notional” 
play. These participants confused their FSE play schedules with real-world constraints. In 
an exercise, the play schedule of an organization can be quite different from the decision 
realm — an organization is bound by certain constraints in an exercise environment (such 
as availability of personnel and costs) that may limit its ability to physically play. 
However, it can make “notional” decisions that reflect what it would do in real life, even 
though the organization may not physically play the decision. In the T3 FSE, some 
organizations made public announcements that some officials interpreted as incorrect 
because that organization was not physically playing for another 24 hours. For example, a 
health organization could decide to open a POD on Day 1 even though it may not be 
physically exercising the POD until Day 2 (if at all). On Day 2, the organization would 
play as though the POD had already been open for a full day and was in its “second” day 
of operation. 

In the T3 FSE, an announcement on the opening of a POD in Middlesex County led to 
significant confusion among decision makers who knew that the POD would not really 
activate until the following day. This led to inconsistent messages by officials that were 
picked up and challenged by VNN reporters. The inconsistent messages were largely a 
result of a lack of coordination and understanding of the difference between notional and 
actual play, rather than any coordination problems that may have existed among the 
participants in making and publicizing the decision. 
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4. Choosing Not lo Follow Procedures 

Some first responders at the incident site in New London, Connecticut chose to forgo 
some of their normal response procedures, causing widespread confusion regarding 
protective action guidance. For example, some of the HAZMAT responders at the site of 
the chemical explosion did not wear personal protective equipment (PPE); meanwhile, 
the Governor of Connecticut was implementing and emphasizing a strict shelter-in-place 
order across the city. VNN Live footage of responders not wearing PPE led VNN viewers 
and reporters to question the rationale for the governor’s policy decision. This 
contributed to some apparent conflicts between FSL government emergency public 
policy decisions, such as whether the shelter-in-place order was still required. 

5. VNN 

Many of the top officials and spokespeople had never participated in an exercise like the 
T3 FSE. Many players appeared to not understand that they were to behave as though 
they were responding to a real-world event. Late-breaking news which was generated as a 
result of player actions (rather than being pre-scripted as injects) required spokespeople 
to be knowledgeable on the unfolding incident and the actions of their agencies, as 
though they were responding to real-world events. A lack of familiarity among 
spokespersons about the nature of exercise play led to variances in the quality of 
preparation and interview effectiveness. Of important note, in the State of New Jersey, 
some public information exercise play was impacted by real-world ongoing flood 
responsibilities. 

Some informational segments on VNN were pretaped and inserted between live 
coverage. For example, VNN aired footage of frightened citizens using duct tape to seal 
off their homes, supposedly in Connecticut in response to the shelter-in-place order. At 
the time the footage aired, the use of duct tape had not yet been specifically 
recommended by any official. For this reason, it was an artificiality. However, to the 
extent that it could have represented an undesired response to a public message (which 
could and does happen in real life), it could have prompted officials to respond with 
clarifying messages. 
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Part 2: Exercise Goals and Objectives 

The following four overarching objectives were established to direct the exercise design 
process for T3: 

• Incident Management : To test the full range of existing procedures for 
domestic incident management of a WMD terrorist event and to improve top 
officials’ capabilities to respond in partnership. 

• Intelligence/Investigation : To test the handling and flow of operational and 
time-critical intelligence between agencies in response to a linked terrorist 
incident. 

• Public Information : To practice the strategic coordination of media relations 
and public information issues in the context of a WMD terrorist incident. 

• Evaluation : To identify lessons learned and promote best practices. 

With these four objectives for a framework, FSL and tribal organizations created their 
own goals and objectives for evaluation through the exercise process. New Jersey and 
Connecticut planners identified specific goals that focused the exercise design process on 
key issues within their respective States. 
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Part 3: Exercise Events Synopsis 


I. Purpose 

This part of the report provides a synopsis of the Top Officials (TOPOFF) 3 (T3) Full- 
Scale Exercise (FSE) scenario. 

II. General 

The T3 FSE scenario provided an environment for participants — primarily top-level 
decision makers — to exercise against a credible terrorist adversary that plans and 
executes an attack employing weapons of mass destruction (WMD). Although the 
scenario is plausible, it contains artificialities necessary to create conditions required to 
achieve exercise goals and objectives. The chain of events depicted in the scenario is 
hypothetical, and the terrorist groups and individuals portrayed in the scenario are 
fictional. 

A. Prelude to the Attack 

I. The Point of Friction 

After the terrorist attacks of September 11, 2001 (9-11), oil supply disruptions in 
Venezuela in 2002 and 2003. and the United States (U.S.) armed intervention in Iraq in 
2003, U.S. policy has increasingly emphasized diversification of U.S. energy supplies, 
especially from sources outside of the Persian Gulf According to Cambridge Energy 
Research Associates, between 2004 and 2010, West and Central Africa (far closer to U.S. 
refining centers than the Middle East) will add 2 to 3 million barrels per day to world 
production. This will account for one in five new barrels of oil (i.e., 20 percent of new 
production capacity worldwide). This oil will be the low sculpture, light product that U.S. 
refiners require. To meet projected rising U.S. demand for natural gas, ample new and 
reliable external sources will also be required. If projects currently under evaluation and 
development in Nigeria, Angola, and Equatorial Guinea are brought to fruition in the next 
decade, they will increase West Africa's annual liquefaction capacity from 9 million to 
30-40 million tons. (Current worldwide capacity is 115 million tons annually.) The 
United States will also increasingly rely on imports of refined products, such as gasoline, 
as U.S. refinery capacity fails to meet growing demand. West and Central African 
refiners can help to fulfill these needs.' 

Since 9-11, U.S. counterterrorism concerns in West and Central Africa have increased 
significantly, resulting in heightened and evolving engagement in the region by U.S. 
intelligence and military personnel. This shift has dramatically reversed the calculation 
that was bom in the immediate aftermath of the Cold War in the early 1990s, in which 


Goldwyn, David L., and Morrison, J. Stephen, "Promoting Transparency in the African Oil Sector: A 
Report of the CSIS Task Force on Rising U.S. Energy Stakes in Africa,” Center for Strategic and 
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West and Central Africa mattered minimally to U.S. global security interests. Indeed, 
West and Central Africa venues are becoming priority zones in global counterterrorism 
efforts, evidenced most overtly by the recent, sudden projection south of the U.S. 
European Command. Current threats and vulnerabilities in this region include: 

• indigenous militant Islamic groups that are concentrated in Nigeria and 
neighboring states and are linked to externally supported local madrassas; 

• the southern migration from Algeria and other North African venues of terrorist 
movements, most notably the Algerian Salafist Movement, which reportedly has 
established training bases in Mali and Niger; 

• increase in the number of Lebanese trading communities, long-standing support 
networks for Hezbollah, some of which are reportedly engaged in illicit diamond 
trafficking, money laundering, and the movement of lethal material; and 

• a rising number of minimally protected economic installations, especially in the 
energy sector, that are overtly tied to Western corporate interests.^ 

Just as it does in the Middle East, oil may eventually form the bedrock of the politics of 
West Africa over the next few decades as the United States develops the region as an 
alternative source to the Gulf. A key objective of a global insurgency inspired by the 
radical Islamist group, el-Zahir, is to deny the United States secure supplies of energy, 
thereby posing a risk to the U.S. economy. 

The expanding threat of international lerrori.sm continues to affect U.S. foreign and 
domestic security. Both timing and target selection by terrorists can affect U.S. interests 
in areas ranging from preservation of commerce to nuclear non-proliferation to the 
Middle East peace process. Complex terrorist networks have developed their own sources 
of financing, which range from nongovernmental organizations and charities to illegal 
enterprises such as narcotics, extortion, and kidnapping. In an attempt to challenge the 
West's conventional military superiority, there is an inexorable trend toward proliferation 
of WMD or the means to make them. Policy makers are concerned that states designated 
by the U.S. State Department as sponsors of terrorism — Cuba, Iran, Iraq, Libya, North 
Korea, Sudan, and Syria — may have supplied terrorists with WMD capability. Although 
there is a degree of uncertainty, the possibility of covert transfers or leakages clearly 
exists.^ 

2, The Emerging Threat - Universal Adversary ( UA ) 

El-Zahir. first designated as a foreign terrorist organization (FTO) by the U.S. 
Department of State in October 1999, is the inspiration for an increasingly violent global 
insurgency. El-Zahir was established by Yemen-born Alim Badi Al Zaman in the late 
1980s. Al Zaman’s worldview was influenced by several renowned radical Islamist 
scholars who taught in the Gulf States. His worldview was also significantly shaped by 


-Ibid., p 14. 

^ Perl, Raphael, Congressional Research Service, “Terrorism and Naiional Security: Issues and Trends,” 
Updated July 6. 2004. 
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his experiences in Afghanistan at the end of the Soviet Afghan campaign. A1 Zaman 
returned to Afghanistan in the 1990s to manipulate civil disorder and establish a string of 
militant training camps. 

The infrastructure that el-Zahir established during this time, which was primarily to 
recruit Muslims to create Islamist states throughout the world, resulted in the growth of a 
global movement that currently extends directly and indirectly into various countries 
including: Algeria, Egypt, Turkey, Syria, Paki.stan, Malaysia, Indonesia, Saudi Arabia, 
Yemen, Chechnya, Somalia, Kashmir, Sudan, and Eritrea. 

In addition to its core membership, el-Zahir has successfully attracted the support of three 
other groups of militant Islamists, including groups fighting Islamic rulers believed to 
have compromised Islamic ideals and interests, groups fighting against oppression and 
repression of the Muslim population, and groups fighting regimes to establish their own 
Islamic state. This wide-ranging support structure has enabled el-Zahir to execute a 
terrorist campaign on several fronts or inspire other militants to execute a terrorist 
campaign. Furthermore, it allows the “network of networks” to employ a wide range of 
tactics, from kidnapping and conventional attacks using improvised explosive devices 
(lEDs) and suicide bombers to unconventional attacks using chemical and biological 
weapons. 

In response to increased U.S. military presence in Central and West Africa, el-Zahir and 
several of its African-based affiliated and inspired groups have developed a plan to 
retaliate against the United States and its allies with a series of coordinated strikes against 
the U.S. homeland and the United Kingdom (UK). 

The scale of the attacks is planned to surpass that of the 9- 1 1 attacks. El-Zahir will 
provide mission support that will include limited financial capital for weaponry, support 
networks in place in the West, access to front companies, and the recruitment of skilled 
weapons technicians. 

The Fronte Salafiste pour la Liberation de Terre Etrangere (FSLTE), an Algerian-based 
terrorist organization loosely affiliated with el-Zahir. will provide tactical forces and 
weapons expertise for this operation. Under the leadership of Ahmed Abdul Aziz (aka 
“A1 Jundi"), the group aims to overthrow the secular government of Algeria and establish 
an Islamist caliphate that adheres to the Salafist interpretation of Islam. Although the 
group has denied issuing statements threatening attacks on U.S. assets in Algeria, they are 
opposed to the U.S. presence in North and West Africa. FSLTE was first designated an 
FTO by the U.S. Department of State in March 2002. 

FSLTE has recruited from the disenfranchised and the embittered. FSLTE has 
particularly concentrated on recruiting from the criminal fraternity in prisons who have 
turned to Islam through the work of radical Mu.slim clerics not necessarily associated 
with FSLTE or any other noted militant group. Most of the funding for the group's 
activities is acquired via criminal activities. 
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To successfully conduct clandestine operations in the West, el-Zahir and FSLTE will rely 
on two additional organizations. In Europe, they will rely on Nasamaah-At, translated as 
“active individuals.” This movement was established in Egypt in the 1970s by Amir 
Haleeb. The group began as a highly disciplined movement that was divided into action 
cells, recruiting groups, and logistic units, and worked toward re-educating the Egyptian 
population to accept a new community governed by Shari'ah law. 

Originally, Nasamaah-At was apolitical and nonviolent. However, after facing growing 
repression by the authorities, the group was radicalized and ultimately resorted to the use 
of violence to initiate change within society. Instead of focusing their efforts in the 
Middle East, Nasamaah-At sent personnel throughout Western Europe to begin their own 
radical cells deep within Western society. Here, the group has focused on recruiting first- 
and second-generation Europeans. Thus, Nasamaah-At has evolved into an unsU'uctured 
entity that is largely ad hoc by nature, but radicalized to the extent that individual cells 
established throughout Europe have sought to build direct and indirect ties to el-Zahir. 
Although the group is well-established throughout Western Europe, the United Kingdom 
is considered the principle transit point for new recruits and a distribution point for the 
“revolutionary message of jihad.” 

The movement has attracted a number of well-educated, unemployed youth who are 
second-generation immigrants from Algeria, Egypt, and Syria who have found 
themselves alienated from the mainstream culture of their respective European countries. 
As a result, they have devoted themselves to radical Islam and the global insurgency 
inspired by el-Zahir. 

In the United States, el-Zahir and FSLTE will rely on Mutaki'oun, a loose network of 
American Islamic radical converts. These operatives were largely recruited from the U.S. 
prison population through the work of radical clerics. These individuals were almost all 
born in the United States, but many have traveled extensively throughout the Middle East 
and Caucasus. Although they maintain a Western lifestyle, they attend mosques where 
they have developed close relationships with other militant Islamists. Most have 
undergone paramilitary training either at camps overseas or at “warrior training” camps 
in the United States. 

Mutaki’oun operational cells — called Sutra teams — are oriented around protecting radical 
clerics at the mosques frequented by these converts. Their training has made them highly 
capable facilitators of terrorist operations through activities such as intelligence 
collection, countersurveillance expertise, weapons acquisition, money laundering, and 
credit card fraud. However, their tactical skills are largely unproven. 


UNCLASSIFIED - rOUO 

This Document Contains Canadian and United Kingdom information 

40 





AAR 


TOPOFF 3 


3. The Contemporary Operating Environment 

a. International 

• Anti-U.S. sentiment continues to simmer across the globe. 

• U.S. troops continue to be stationed and active in Afghanistan and Iraq, as well as 
other countries throughout the Middle East, Central Asia, and Africa. 

• El-Zahir has released several statements through al-Jazeera and through key 
Islamist websites that contain general threats against the United States and its 
allies (particularly the United Kingdom, Canada, Italy, and Australia). 

• Canada and the United States are exploring new approaches to border security and 
monitoring under the watchful eye of Canada's new Prime Minister. 

b. National 

• The nation is in a post-presidential election period, with the administration 
attempting to address key national concerns, including homeland security, the 
economy, and foreign policy. 

• The U.S. intelligence community has detected an increasing level of “chatter” 
among known and suspected radical Islamists both inside and outside the 
continental United States. 

• The Homeland Security Advisory System (HSAS) threat level is currently set to 
Yellow (ELEVATED - Significant Risk of Terrorist Attacks). 

c. Regional 

• In the northeastern United States, State and local law enforcement officials have 
been engaging with Joint Terrorism Task Forces throughout the region regarding 
growing concerns over the increasing activities of the Mutaki’oun. 

• During the holiday season, ongoing concerns over port and transportation 
security, combined with a significant spike in Islamist “chatter” noted by the 
intelligence community, led the DHS to issue an elevation of the HSAS level to 
Orange (HIGH - High Risk of Terrorist Attacks) for the New York, NY; Boston, 
MA: and Washington, D.C. metropolitan areas. The rest of the nation remains at 
HSAS level Yellow. 

d. Local 

• Throughout these areas, including northern New Jersey, State and local 
governments were forced to address the economic impact of an elevation in the 
HSAS level over the holidays, leading to increased concerns over how to pay for 
the fluctuating costs of supporting homeland security measures. 
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B. The Attack Plan 

1. UA Targeting Priorities (Posted on a Radical Islamist Website) 

The following is a translation of The Battar Training Camp (Mu’askar Al-Battar), The 
7th Edition, March 2004. The text below is exactly as it was released. Inaccuracies were 
not corrected for publication of the T3 FSE scenario. 

2. Targets Inside Cities'^ 

Attacks inside cities are considered a kind of militant diplomacy; this kind diplomacy 
usually is written with blood and decorated with body parts and gunpowder. 

These attacks carry a political meaning related to ideological struggle; it is considered a 
message to several parties. Therefore it is very important to be detailed in selecting 
targets. A good example of this is the attacks by our brothers, those attacks by the heroes 
(Khalid Al-Sa’id, Riyad Al-Hajri, Abd-al-Aziz Al-mi’shim and Muslih Al-Shamrani) 
was the beginning. Their choice for a target was a great success. The building belonged 
to the CIA. This was the spark that ignited our Jihadi youth and opened the eyes of the 
nation to the Zionist presence in the land of Mohammad. 

Also the attack in east Riyadh in 2003 was a message to the enemy, telling them that here 
we are, we have attacked you before and we can attack you now. you cannot hide because 
we are after you and you cannot get comfortable in the land of Mohammad. 

Also the attacks by our brothers; Ali Al-Ma'badi and Nasir Al-Sayyari that targeted Al- 
Muhaya on the Intelligence Center were successful too. This proves that the attacks are 
diplomatic messages written with blood and decorated with body parts and gunpowder. 

3. Religious Targets 

It is not advisable to do any attacks against religious targets at the beginning of a Jihadi 
movement unless one of the following situations applies: 

• When groups are involved in converting Muslims to Christianity like what 
happened in Yemen and what is happening in Iraq. Also in Saudi Arabia where 
Christians are trying to distribute bibles. In these cases they should be hunted 
down. 

• Intelligence Activity hiding under a religious cover. In the case when it is a 
Muslim that is under cover he should not be attacked because Jihad movement 
can get a bad reaction from the public and it can backfire. 


4 

From a translation of Abu Hajir Abd-al-Aziz Al-Manun's The Bailor Training Camp (Mu'askar Al-Boltarj, The 7ih 
Edition, March 2004. (hltp://tides-carebridge-org/Translalions/TWPR-AI-Baltar-7.htm)- 
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• In the case when some priests and rabbis and religious figures attack Muslims or 
Islam like that American priest that cursed the prophet Mohammad, we ask God 
to bring our swords closer to his neck. Also when Sayid Nsair killed Kahana who 
cursed the prophet. 

• In the cases where Christian and Jewish figures are conducting financial, moral, 
and militant campaigns against the Muslims like the previous crusades. 

4. Financial Targets 

The goal for attacking these kinds of targets is to shake the security and the environment 
for financial growth like attacking the oil pipelines in Iraq that prevented foreign 
companies from joining in stealing the Muslims fortunes. Also one of the goals is to get 
foreign investors to get out of the local market. Also, the affect of these attacks on the 
financial powers like the attacks in Madrid that damaged the crusaders economy. Here 
are some practical examples of these financial targets: 

• Jewish and Crusaders investment in the lands of the Muslims. 

• International companies. 

• International Economical experts. 

• Attacking imports from crusaders’ countries or boycotting them. 

• Attacking the crude materials stolen from the lands of the Muslims like oil 
carriers or pipelines. 

• Assassinating Jewish people that work in financial field and teaching those that 
work with them a lesson. 

5. Human Targets 

We have to kill the Jews and the Christians. We have to tell everyone that fights Muslims 
that we are coming to kill you. We should not be divided by geographical borders. The 
land of the Muslims is our land. We have to turn the countries of the enemies to hell the 
way they turned our lands to hell. All the cells, where ever they are should be active and 
disregard any borders that were drawn by the enemy. 

• In this case, priority is for Jewish and Christian officials in the land of the 
Muslims and the goal is not to let them get comfortable. We advise you to target easy 
targets at the beginning and priority goes to the infidels that directly support the local 
rejecters of Islam. For example, the targets in Saudi Arabia should be the Americans 
first and the English second; in Iraq, the Americans; in Afghanistan, the Americans; 
in Algeria, the French; in Indonesia, the Australians. 

• The Human targets are in these categories: 

o Jews, and they are divided in categories, for example The Jews of America 
and Israel and the Jews of the UK and France. 
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o Christians are ranked in the following order: 

■ Americans 

■ UK 

■ Spanish 

■ Australians 

■ Canadians 

■ Italians 

• These will also be divided into the following categories: 

o Finance and businessmen, for money is important in this day and age. 
o Diplomats, politicians, intellectuals and political delegations, 
o Military leaders and soldiers. 

o Tourists and all those that were warned by the Mujahidin. 

• Collaborators are good targets and are ranked as follows: 

o Those with close ties to the Christian and Jewish governments like Husni 
Mubarak of Egypt and the rulers of Arabian Peninsula and their advisors, 
o The liberals and the seculars who have harassed the faith, 
o Spies and Intelligence, they are shielding and protecting the Jews and the 
strong-arm of the collaborators rulers. 

6. The Goals of Targeting Humans 

• To provide clarification of the nature of the conflict. By tai geting Christians and 
Jews it shows that this is a religious struggle. 

• To show the main enemy. 

• To cleanse the earth of these people and to deter others. 

• To spread fear in the enemy and this is a requirement documented in Koran. 

• To raise the morale of the Islamic Nation. 

• To destroy the image of the government that was targeted. After the 9/1 1 attacks, 
America’s nose was in the dirt. 

• To disrupt the plans of the infidels, like the time when Italy refused to send troops 
to Iraq. Also like what happened in Spain where the challenger of the prime 
minister promised to pull the troops out the Iraq after the attacks in Madrid. 

• To punish them for killing the Muslims. 

7. The Pros of Attacks in Cities 

• Raising the morale of the nation and of the Mujahidin. 

• Confirming the credibility of the Jihadi group in the society. People will be able 
to see and the media cannot lie to the public. 

• Forcing the regime not to cross red lines. 

• Testifying that there is no God but Allah and Mohammad is his prophet and for 
achieving unity. 

• The governments will lose their effective symbols. 
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• Influencing the economies of those countries. 

• The Mujahidin gain experience and qualification that will make them leaders of 
the nation in the future. 

• Study and analysis of mistakes that need to be avoided in the future. 

• Preparing the nation and the brothers for future wars and confrontations. 

• Winning sympathizers and increasing the popularity of the Mujahidin with every 
successful operation. 

• Forcing the regime to change their policies. 

• Shaking the trust and the confidence of the members of the regime. It could also 
cause clashes between the military and political powers in the country and cause 
disagreement among the political parties. 

8. The Cons of Attacks in Cities 

• The killing of Jihad leaders and members once these attacks are discovered. 

• Lots of human and material damage. 

• Lowers the morale of Mujahidin in cases of failure. This is why a good leader 
raises the morale of his people in any case. 

• Gives the regime a chance to take advantage of the situation and harm innocents. 

• Raises the morale of the members of the regime when they win the battles. 

• Some members of the Jihad can be captured and secrets could be uncovered. 

• Weakening in the trust between the Jihadi groups and the society in case of 
repeated failures. 

9. UA Specified And Implied Mission Tasks 
a. Specified Tasks 

• El-Zahir will provide access to weapons material and technical expertise, 
ideological justification and inspiration, and limited direction and financial 
support. 

• FSLTE will plan and conduct compartmented tactical planning, preparations, 
rehearsals and execute attacks against New York City and Boston employing a 
combination of large vehicle bombs, chemical and biological weapons. 

• FSLTE will coordinate support activities and train operatives from Mutaki’oun to 
assist with the execution of Vehicle Borne Improvised Explosive Device 
(VBIED) and chemical/biological weapons attacks against New York City and 
Boston. 

• FSLTE will conduct compartmented tactical planning, preparations, rehearsals 
and execution of a chemical attack at specified targets in London, UK. 

• Nasamaah-At will conduct a series of attacks against specified targets in London, 
UK. 
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b. Implied Tasks 

• Operational security will be strictly observed: 

o Tactical elements will remain unaware of each others activities, 
o Communication with tactical elements will kept to a minimum. 

• Individual targets will be selected by FSLTE cell leaders to achieve desired 
outcomes. Selection criteria will be based on anticipated weapons effects, analysis 
of security measures, and on the results of reconnaissance and surveillance. 

10. Desired Outcomes 

• Demonstrate our resolve to fight the United States and their allies with all means 
available by doing the unthinkable — releasing biological and chemical agents 
against the general population in the United States and United Kingdom. 

• Create mass casualty events to demoralize the general population and create an 
atmosphere for them to challenge their governments’ foreign policies toward 
Islam. 

• Cripple the U.S. economy by disrupting commerce and forcing an increase in 
security measures nationwide. 

• Drive a wedge between the U.S./UK alliance. 

• Force the United States to deploy additional forces to Central and West Africa to 
ensure access to oil supplies, further stretching military resources and relieving 
pressure on mujahideen in Afghanistan and Iraq. 

• Destabilize the governments of Central and West Africa to facilitate conditions 
favorable to an expansion of the global Salafisi insurgency. 

C. Attack P^xecution Timeline 

1. Concept of Operations 

Universal Adversary elements are planning to conduct a coordinated strike using WMD 
on Boston, Massachusetts; New York, New York; and London, United Kingdom. Their 
concept of operations includes the following: 

2. Premission activities 

• Infiltrate command and control elements and CW/BW agents into the United 
States and the United Kingdom. 

• Establish safe houses/laboratories in the United States and the United Kingdom. 
The Boston attack will be staged from Connecticut, and the New York City attack 
will be staged from New Jersey. 

• Produce and weaponize CW/BW agents. 

• Construct vehicle-borne lEDs (VBIEDs). 

• Organize support within Mutaki’oun (U.S.) and Nasamaah-At (UK). 

• Conduct reconnaissance and surveillance of possible targets. 
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• Select targets. 

• Conduct mission rehearsals. 

3. Mission execution 

• April 2, 2005: Under the operational control of FSLTE, Mutaki’oun operatives 
conduct a BW attack against New York City. 

• July 4, 2005: FSLTE and Mutaki’oun operatives conduct combined VBIED/CW 
attacks against Boston. 

• July 4, 2005: FSLTE and Nasamaah-At conduct multiple CW and lED attacks 
against London. 

4. Post-mission activities 

• FSLTE (U.S.) command and control element exfiltrates through Canada to 
Algeria. 

• Mutaki'oun and Nasamaah-Al operatives go underground in the United States and 
the United Kingdom. 


D-400TOD47 


D-400 (February 29. 2004) 

Tribal Areas, Pakistan 

El-Zahir releases a statement via their propaganda channels (including the magazine A1 
Battar) that receive wide distribution in North Africa and Western Europe. The statement 
discusses the need to bring jihad to the door of coalition members of the U.S. -led Global 
War on Terrorism as retribution for their continued abuses against Islam. 

l)-380 (March 20. 2004) 

Mauritania, Africa 

FSLTE command conducts initial attack planning with Faisal Diya Amid “A1 Hakam” 
(FSLTE Chief of Operations) present. Faced with increased counterterrorism activity in 
Algeria, the command group meets in Mauritania. 

D-375 (March 25. 2004) 

Mauritania, Africa 

FSLTE uses el-Zahir communications channels to request operational support. Khatib 
‘Adli (the el-Zahir Operations Coordinator) returns a secure message to FSLTE to meet 
for further discussion. In anticipation of receiving support from el-Zahir to procure 
chemical and biological agents, AI Hakam uses secure internal group communications to 
activate Ismail Husam al Din (FSLTE Chemical Weapons Expert) and Fatima Barakah 
(FSLTE Biological Weapons Expert). 
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D-370 (March 30. 2004) 

Johannesburg, South Africa 

Khatib ‘Adli and A1 Hakam discuss operational details and how el-Zahir could support 
the FSLTE-initiated attacks. El-Zahir agrees to facilitate access to biological and 
chemical agents, 

D-362 (April 7. 2004) 

Algiers, Algeria 

FSLTE releases a statement via their new globally distributed Internet publication. The 
statement discusses the need to bring jihad to the doorsteps of the coalition members as 
retribution for their continued abuses against Muslims. 

D-355 (April 14. 2004) 

Mauritania, Africa (Wahhabi Madrassa) 

FSLTE decides to activate U.S.- and UK-based support cells to conduct local target 
surveys. An FSLTE messenger begins travel to Frankfurt to deliver an activation message 
to a French-based FSLTE operative, who is to deliver the message to Bilal Id Habib 
(FSLTE Tactical Leader, United Kingdom) in London. Using an encrypted message, each 
cell is given a timeline of operations and details for secure communications channels to 
be used for this operation. 

D-350 (April 19. 2004) 

Boston, Massachusetts 

The FSLTE cell in the United States is activated via human courier by A1 Hakam, who 
will also serve as the U.S. FSLTE Tactical Leader. 

Frankfurt International Airport, Germany 
The FSLTE UK cell is activated. 

Karachi, Pakistan 

Fatima Barakah receives Yersinia pestis {Y. pestis) seed stock from Europe and South 
America via airmail and begins production. 

D-340 (April 29. 2004) 

Boston, Massachusetts and New York, New York 

A1 Hakam activates Mutaki'oun support cells located in Boston and New York City. A1 
Hakam has established a relationship with radical imams who preach at closed study 
groups in New Jersey and Connecticut. A1 Hakam asks Ismail A1 Muhaat (a local imam) 
to deliver a message to Ali Waddab Bishr (Mutaki'oun Communications, New Jersey). 
A1 Hakam also asks Hanouf Khan (a local imam) to deliver a similar message to Aqil 
Azhar Kutaiba (Mutaki'oun Security, Connecticut). Mutaki’oun support cells are given 
limited information apart from the type of support that is needed (e.g., to rent a house, 
obtain specific supplies, etc.). 

A1 Hakam also directly activates the New York City operational cell of Mutaki’oun 
through his personal ties to Zafir Hamal (Mutaki’oun Tactical Leader, New Jersey). The 
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operational cell is given a targeting package but no dates. Dates will be provided to 
Mutaki’oun closer to D-Day. 

Ijyndon, United Kingdom 

Bilal Id Habib activates Nasamaah-Al through an established operational relationship 
with Basir Imad Rahman (Nasamaah-At Tactical Cell Bravo Leader). The Nasamaah-At 
operational cell is given an attack timeline and access to an FSLTE secure 
communications channel. The communications channel will ensure that Rahman’s cell 
has access to all required support necessary to fulfill its mission objectives. 

Habib further activates “Tactical Cell Alpha” and the UK Nasamaah-At support cell 
through Fawzi (FSLTE Spiritual Guide and Commander). Fawzi is given a secure 
message that he delivers to Alima Durrah Hafa (Nasamaah-At Communications) and 
Marid Fouad Bakri (Nasamaah-At Tactical Cell Alpha Leader). 

D-310 (May 29. 2004) 

Boston, Massachusetts 

Falih al Hakam Hadi (FSLTE Intelligence and Security, Connecticut) conducts target 
reconnaissance and surveillance and relays target intelligence to the cell commander, Al 
Hakam. Hadi also coordinates remote targeting for New York City and builds a targeting 
package that is to be forwarded to Zafir Hamal by Al Hakam. 

New York, New York 

Al Hakam forwards the targeting package to Zafir Hamal by posting it to a covert 
website. After receiving the targeting package. Hamal is ordered to conduct more detailed 
reconnaissance and surveillance in New York City and choose the most vulnerable 
symbolic targets. The final list is to be reposted on the covert website for Al Hakam to 
retrieve. 

London, United Kingdom 

Marid Fouad Bakri and Basir Imar Rahman conduct target reconnaissance and 
surveillance and attack planning. 

D-280 (June 28. 2004) 

Karachi, Pakistan 

Fatima Barakah completes production of the Y. pestis and departs Karachi for Beirut, 
Lebanon, where she undergoes plastic surgery to alter her appearance. 

D-275 (July 3. 2004) 

Algiers, Algeria 

Ismail Husam al Din begins the first phase of sulfur mustard (HD) precursor production 
with chemicals acquired through the el-Zahir network. 
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D-225 (August 22. 2004) 

Algiers, Algeria 

Ismail Husam al Din ships HD precursor chemicals to London via Rotterdam for a 
second phase of processing and prepares to travel to the United Kingdom to oversee final 
production. 

D-212 (September 4. 2004) 

Beirut, Lebanon 

After successful plastic surgery, Fatima Barakah departs Beirut for New York's Kennedy 
Airport, via Madrid, Spain, using commercial air. 

D-210 (September 6. 2004) 

New York, New York 

Fatima Barakah arrives at John F. Kennedy International Airport, where she is met by 
Shihad bin Zaki (Mutaki’oun Security, New Jersey). Barakah is escorted to a safe house 
south of Iselin, New Jersey. 

D-207 (September 9. 2004) 

Newark, New Jersey 

An FSLTE messenger arrives at the international airport in Newark. New Jersey from 
Karachi, Pakistan via Madrid, Spain, where he is met by Shihad bin Zaki. The messenger 
delivers 50 percent of the K pestis seed stock concealed in the battery compartment of a 
cellular telephone. 

D-200 (September 16. 2004) 

London, United Kingdom 

Bilal Id Habib relocates to the safe house to oversee equipment procurement and receipt 
of transshipment of the HD precursor and to prepare for the arrival of Ismail Husam al 
Din from Algiers. 

Middlesex County, New Jersey 

Yasir Raja Abdul {Mutaki’oun Logistics, New Jersey) and Fatima Barakah coordinate 
acquisition of her lab equipment needs. 

D-195 (September 21, 2004) 

London, United Kingdom 

Al Hakam arrives at the FSLTE safe house from Algiers to oversee operational 
preparations. 

D-190 (September 26, 2004) 

London, United Kingdom 

Ismail Husam al Din arrives at the FSLTE safe house to conduct the second phase of HD 
production. 
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D-182 (October 4. 2004) 

Newark, New Jersey 

An FSLTE messenger arrives at the international airport in Newark. New Jersey from 
Karachi, Pakistan via Athens, Greece, where he is met by Shihad bin Zaki. The 
messenger delivers the remaining 50 percent of the Y. pestis seed stock concealed in the 
battery compartment of a second cellular telephone. 

D-I81 (October 5. 20041 
Middlesex County, New Jersey 

Fatima Barakah begins full-scale production of the Y. pestis agent. 

1)-180 (October 6. 2004) 

Newark, New Jersey 

A1 Hakam arrives in the United States from London to oversee final production of Y. 
pestis, synthesis of HD, and other operational preparations. 

D-172 (October 14. 20041 
A^ch' London, Connecticut 

A1 Hakam tasks two FSLTE cell members who are licensed pilots (Jamil Abu al Khayr 
(FSLTE Communications, Connecticut] and Falih al Hakam Hadi) to develop air routes 
over populated areas in Boston for aerial dispersal of the HD agent, 

D-121 (December 4, 2004) 

New London, Connecticut 

Rafi’ Dhak-wan Aziz (Mutaki’oun Finance and Logistics, Connecticut) procures the 
agent dispersal equipment. 

Middlesex County, New Jersey 

Yasir Raja Abdul orders agricultural sprayers. 

P-60 (February 3. 2005) 

London, United Kingdom 

Ismail Husam al Din begins sending the HD precursor material (TDG) to New Haven, 
Connecticut in four separate shipments. 

D-49 (February 14, 2005) 

Middlesex County, New Jersey 

Yasir Raja Abdul purchases three used sport utility vehicles (SUVs) from private 
citizens, with cash, at three different northern New Jersey locations for use in the attacks 
on New York City. They are stored in a warehouse until the agent is ready. 

D-45 (February 18. 2005) 

London, United Kingdom 

Ismail Husam al Din completes weaponization of HD for use on UK targets and boards 
an aircraft for Hartford, Connecticut via New York, New York. 
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D-30 (March 5. 2005) 

New London, Connecticut 

The first shipment of TDG arrives in the United States from the United Kingdom. It is 
retrieved by Aqil Azhar Kutaiba (Mutaki’oun Security. Connecticut) and transported to a 
safe house. 

Union and Middlesex Counties, New Jersey 

Mutaki’oun operatives begin rehearsing driving routes from New Jersey to New York 
City in their personal vehicles. 

D-20 (March 15. 2005) 

New London, Connecticut 

Jamil Abu al Khayr and Falih al Hakam Hadi begin rehearsing a flight plan in their time- 
share twin-engine Beechcraft Baron (model B-58) over Boston, Massachusetts. 

D»13 (March 22. 2005) 

Middlesex County, New Jersey 

Fatima Barakah completes production of Y. pestis, and weaponization begins. 

D-6 (March 29. 20051 
New London, Connecticut 

Ismail Husam al Din completes aerial dissemination device. 

D-4 (March 31. 2005) 

New Haven, Connecticut 
0900 

Law enforcement and intelligence agencies identify the ship carrying the second 
shipment of TDG 1,200 nautical miles from the U.S. coast. The subject vessel is 
identified as Liberian-registered with a foreign crew. 

D-3 (April L2005) 

Newark, New Jersey 
0800 

Fatima Barakah boards a commercial flight to Miami, Florida. Her plan is to leave Miami 
for Brazil on a connecting flight. 

Middlesex County, New Jersey 
2300 

Mutaki’oun operatives load the K. pestis agent into the sprayers and prepare for 
deployment as planned. 
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D-2 (April 2. 2005) 

Union and Middlesex Counties, New Jersey 
0200 

Zafir Hamal, Fatih Yaman Ihsan, and Jibran Al Mash’al drive three SUVs outfitted with 
biological weapon (BW) dissemination devices toward New York City to execute their 
mission. As the vehicles are making their way toward the city, a confrontation with an 
off-duty police officer at a New Jersey Turnpike rest stop, followed by a call to 
authorities, cause.s one of the drivers to panic. He believes that the mission is 
compromised and communicates this to the other drivers while fleeing the scene of the 
incident. The operatives make the decision to avoid New York City and disseminate as 
much agent as possible in New Jersey on the Garden State Parkway, US 1/9, and NJ- 
1 8/New Jersey Turnpike. 

By pure coincidence, April 1 was the final day of an international financial services 
industry conference held at the Sheraton at Woodbridge Place Hotel in Iselin, New 
Jersey. Many delegates from the United Kingdom and Canada remained overnight. 

Union and Middlesex Counties, New Jersey 
0600 

The New Jersey tactical team abandons their vehicles. Using a one-use emergency 
mobile phone provided to him, Zafir Hamal quickly communicates the belief that their 
mission was compromised to Al Hakam. Hamal describes their hasty actions to avoid 
capture, and Al Hakam makes the decision to accelerate the Connecticut cell’s attack 
timeline due to the potential for immediate police involvement. He believes that the 
compromised New Jersey operation will lead the police to the Connecticut cell prior to 
their planned July attack on Boston, Massachusetts. 

New London, Connecticut 
0800 

Al Hakam requests that the UK-based Nasaamah-At accelerate their timeline as well. 

Newark, New Jersey 
0900 

Fifteen UK nationals who attended the financial industry trade conference at the 
Woodbridge site board an airplane for Gatwick International Airport. Approximately half 
of them have been infected, but they are still asymptomatic. 

New London, Connecticut 
1200 

Al Hakam and his accomplices devise their hasty attack plan. After discussions with 
Ismail Husam al Din. it has been decided that they are incapable of mounting any attack 
using HD for at least two days. They are not prepared to mount an attack on Boston due 
to a lack of scheduled public gatherings in the immediate timeframe and incomplete 
reconnaissance and surveillance. Additionally, they only have one VBIED that is close to 
completion, and the Y. pestis incubation period will likely result in casualties beginning 
April 4. There is a local festival occurring at the New London City Pier on April 4 that 
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will present an opportunity for them to use their HD on as many as 10,000 people. A1 
Hakam makes the decision to attack this festival. The single completed VBIED will be 
used in conjunction with the aerial contamination to maximize casualties. 

Bayonne, New Jersey 
1300 

A cruise ship departs for St. John, New Brunswick, Canada with six infected, but still 
asymptomatic, victims on board. The victims were attendees at the financial industry 
convention at the Sheraton Woodbridge in Iselin, New Jersey. Four are Canadian 
citizens, and two are UK citizens. 

D-i (April 3. 20051 

New Brunswick, New Jersey 

0930 

The first victim of the biological attack, a 14-month-old girl, is admitted to Robert Wood 
Johnson University Hospital. 


STARTEX 


D-Dav (April 4, 2005) 
iMndon, United Kingdom 
0200 (0700 GMT) 

The infected UK attendees of the financial conference in New Jersey go to work at their 
respective firms as usual. 

Union and Middlesex Counties, New Jersey 
0800 

Three victims are admitted to Union, Trinitas, and Raritan Bay Hospitals. The victim 
admitted to Union Hospital arrives by Emergency Medical Services and is coughing up 
blood. 

Union County, New Jersey 
0900 

One of the abandoned SUVs is discovered by local security in a parking lot at Kean 
University and is reported to police. The agricultural sprayer is still in the SUV. The 
police quickly determine that this vehicle is the same one involved in the incident on 
April 2 and send investigators to the scene. 

St. John, New Brunswick, Canada 
1000 

The cruise liner arrives from Bayonne, New Jersey. Four of the six infected passengers, 
who are now becoming symptomatic, disembark. 
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New London, Connecticut 
1100 

Preparations are complete, and A1 Hakam orders the operation to be executed 
immediately. A1 Hakam, Ismail Husam al Din, and Jamil Abu Al Khayr bring their 
weapon to the Groton-New London airport, install it in their aircraft, and take off en route 
to the target. 

New London, Connecticut 
1120 

As the aircraft approaches New London City Pier, the aircraft disperses its entire HD 
payload over the area, contaminating the west bank of the Thames River and the 
downtown riverfront area. Approximately 8,000 people are contaminated with HD. This 
is a covert release, and people begin departing the area approximately 10 minutes later 
without knowing that they have been contaminated. 

Upon completion of the attack, the plane turns north toward Canada. The operatives' plan 
is to land the aircraft at a remote airfield in Deblois, Maine, and make their way on land 
to Canada via the border at Calais. Maine - St. Stephen, New Brunswick. 

New London, Connecticut 
1300 

Victims of the HD attack are becoming symptomatic and are seeking medical attention at 
the first aid tent on the pier. 

Deblois, Maine 
1310 

As planned, the aircraft carrying Al Hakam, l.smail Husam al Din, and Jamil Abu al 
Khayr lands at a remote airstrip. The operatives abandon the aircraft and head for the 
border at Calais. Maine - St. Stephen, New Brunswick with a Canadian accomplice who 
has crossed into the United States to provide them with transportation to Canada. 

New London, Connecticut 
1320 

As victims of the HD attack begin to form a crowd at the first aid tent on the pier, Falih 
Al Hakam Hadi detonates his VBIED, martyring himself and destroying the first aid tent 
at the festival. The VBIED contains the remaining HD that was not used in the aerial 
attack. The VBIED attack causes the collapse of several structures and results in 
approximately 200 casualties. 

New London, Connecticut 
1415 

HAZMAT field screening indicates presumptive identification of HD agent. 
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New London, Connecticut 
1430 

911 calls begin coming in from around the greater New London area reporting symptoms 
of HD contamination. 

Calais, Maine 
1450 

A1 Hakam, Ismail Husam al Din, Jamil Abu AI Khayr, and their Canadian accomplice 
cross the Canadian border. 

St. Stephen, New Brunswick 
1500 

The Canadian driver is detained by Canadian authorities, and Al Hakam. Ismail Husam al 
Din, and Jamil Abu Al Khayr flee the scene in the vehicle. 

St. John, New Brunswick, Canada 
1600 

The cruise liner continues to Halifax with two of the six original victims. 

Union County, New Jersey 
2000 

A presumptive diagnosis of Y. pestis is established based on patient epidemiology, 
laboratory results, and a swab taken from the abandoned SUV at Kean University. This 
information is communicated to the United Kingdom and Canada via the World Health 
Authority. 

St. John, New Brunswick, Canada 
2230 

The first victim of the New Jersey biological attack who went ashore in St. John is 
admitted to a local hospital. 

D+1 (April 5. 2005) 

New London, Connecticut 
0645 

Dozens of trucks loaded with food, blankets, medical supplies, and so forth arrive at the 
blast site, escorted by hundreds of volunteers who want to help. People are milling 
around the site, and the investigators and first responders are having difficulties 
containing the eager volunteers and the supplies that they are bringing. People who have 
already shown up say that many more volunteers and supply trucks are on their way. 

Middlesex County, New Jersey 
1400 

Investigation of the SUV leads to the discovery of the location of the biological weapons 
production facility used by FSLTE and the Mutaki'oun. 
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Halifax, Nova Scotia, Canada 
1415 

The second, third, and fourth cruise ship passengers who are victims of the biological 
attack in New Jersey present at St. John Hospital. 

Middlesex County, New Jersey 
1500 

Investigation of the SUV leads to the discovery of the location of the Mutaki’oun safe 
house. 

Halifax, Nova Scotia, Canada 
1500 

The cruise ship arrives in the Halifax area. No victims disembark. 

Newark, New Jersey 
1800 

A second SUV is discovered abandoned on Avenue “C" near the airport. 

New London, Connecticut 
2300 

Law enforcement and intelligence agencies identify the ship carrying the third shipment 
of TDG in U.S. waters. The subject vessel is identified as Liberian-registered with a 
foreign crew. 

D+2 fApril 6. 20051 
New London, Connecticut 
0900 

An investigation leads to the discovery of the chemical staging facility used by FSLTE 
and the Mutaki’oun. Evidence discovered in this facility confirms connections to the 
United Kingdom and suggests an imminent threat there. 

London, United Kingdom 
1200 

The discovery of a VBIED similar in design to the one detonated by the FSLTE in New 
London, Connecticut, marks the beginning of a series of terrorist attacks in London 
targeted against the transportation infrastructure. 

Deblois, Maine 
1800 

The abandoned aircraft used in the Connecticut attack is discovered. 
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D+3 (April 7. 2005) 

London, United Kingdom 
TBD 

An investigation leads to the discovery of the chemical weapons production facility, 
which contains some of the precursor chemicals previously shipped to the United States. 

London, United Kingdom 
1200 

Chemical devices are activated on mainline trains arriving at Waterloo International Rail 
Terminal, the station concourse, and the adjacent Underground station. Casualties include 
U.S. citizens. 

D+4 (April 8. 20051 
Yarmouth, Nova Scotia, Canada 
1000 

The fourth and final shipment of TDG is identified on a vessel currently located in the 
Atlantic en route from London. United Kingdom to Yarmouth, Nova Scotia. 
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Part 4: Analysis of Mission Outcomes 

In an exercise as large in scope and depth as T3, the opportunities for analysis are significant. 
Based on post-exercise meetings among participants, the T3 After-Action Conference (AAC), 
and observations by subject matter experts during the exercise, 10 elements of the operation were 
selected for in-depth analysis. The topics discussed in this report include the following: 


Broad 

Mission 

Outcomes 

• The Homeland Security Advisory System (HSAS) 

• Joint Field Office (JFO) Operations 

• Resource Requesting and Resource Coordination 

• Information Sharing 

Critical 

Tasks 

• Stafford Act Declarations 

• Emergency Public Information 

• Integrating Responses to Incidents of National Significance (INSs): 
Public Health Emergency and the Stafford Act 

• The Strategic National Stockpile (SNS) and Points of Dispensing 
(PODs) 

• Agent Confirmation and Hazard Area Definition 

• Emergency Response Operations under a Unified Command (UC) 


The selection of these 10 topics in no way suggests that other issues were not worthy of analysis. 
Rather, these issues involve sequences of events that attracted great interest; new or developing 
organizations and procedures; and elements of the exercise that seemed problematic or well- 
played. Nothing should be presumed about a topic or issue that was not selected for analysis. 

This section of the report provides an analysis of the four issues identified as Broad Mission 
Outcomes and addresses how well the participating agencies/jurisdictions dealt with these 
significant issues. Mission outcomes are those broad areas of service or functions that the public 
expects from its officials and agencies. As defined in the Office for Domestic Preparedness’ 
Homeland Security Exercise and Evaluation Program (HSEEP) - Volume II: Exercise 
Evaluation and Improvement, the mission outcomes include: prevention/deterrence, emergency 
assessment, emergency management, hazard mitigation, public protection, victim care, 
investigation/apprehension, and recovery/remediation. Analysis of the more specific issues, 
identified as Critical Tasks, and the activities and proce.sses that contributed to their results are 
found in Part 5. 
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I. The Homeland Security Advisory System (HSAS), State Threat Conditions, 
and Associated Protective Measures 

A. Introduction 

President George W. Bush signed Homeland Security Presidential Directive (HSPD)-3, which 
created the HSAS to improve coordination and communication in the event of a threat of terrorist 
attacks. The HSAS is meant to “disseminate information regarding the risk of terrorist acts to 
Federal, State, and local (FSL) authorities and to the American people.*” The HSAS has two 
stated purposes: first, it informs Federal, State, and local governments and the public of the 
perceived credibility and imminence of threats; second, it directs a systematic, coordinated 
governmental response to such threats to “reduce 
vulnerability or increase response capability.” 

The system uses colors (from Green to Red) to 
define threat conditions from low to severe. Since 
its creation on March 11. 2002, the HSAS threat 
condition has been increased from Yellow 
(Elevated) to Orange (High) seven times, ^ most 
recently in July 2005. The threat condition has 
never been lower than Yellow or higher than 
Orange. The first full-scale test of an elevation to 
Red (notional) occurred in the T2 FSE (May 2003). 

To date, the HSAS has only been elevated to Red 
during exercises. All such elevations to Red have 
been in response to attacks rather than being based 
on preattack threats. 

Implementation of the HSAS, and specifically the 
Red threat condition, has been clo.sely examined in 
three previous exercises — the T2 FSE, T3 CPX, 
and Senior Officials Exercise (SOE) 04-4, Crimson 
Dawn. The T3 FSE demonstrated that previously 
identified issues still persist and underscored some 
questions regarding the protective value of HSPD- 
3 as currently implemented through the HSAS. The 
core issue demonstrated in the exercises that have 


' President George Bush, Homeland Security Presidential Directive-."?, March 1 1, 2002. 

’ September 10-24, 2003; February 7-27, 2003; March 17-April 16, 2003; May 20-30, 2003; December 21, 200.3- 
January 9. 2004; August 1-November 10, 2004 (Banking/Financial sector only for NY. NJ, and Washington, E)C); 
July 7, 2005-present (ma.ss transit only). 


Sl’MMARv OK Concussions: 

Homeland Security Advisory System 

• Real-world and exercise elevations of the 
HSAS to Orange and Red indicate that 
implementation of the HSAS was not 
systematic. 

• There did not appear to be a formal 
mechanism for coordinating, reporting, 
and tracking HSAS and State threat level 
changes and implementation of associated 
Federal, State, local, and private sector 
protective measures. 

• The absence of a mechanism for 
coordinating the implementation of 
protective measures contributed to an 
uncoordinated response. 

• Unintended consequences of 
implementing HSAS Red protective 
measures were not well understood. 

• Officials in the T3 FSE used the HSAS 
and State threat conditions more as a 
means of facilitating emergency response 
operations than as a threat advisory 
system. 

• Inconsistent messages and little specific 
public guidance limited the value of the 
HSAS as a waming/advisory system. 
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examined the HSAS — most recently the T3 FSE — is that the HSAS is still not used in a 
systematic manner and therefore is not effectively achieving the objectives detailed in HSPD-3. 

B. Background 

The HSAS is “intended to create a common vocabulaiy, context, and structure for an ongoing 
national discussion about the nature of the threats that confront the homeland and the appropriate 
measures that should be taken in response.” Whereas the HSAS defines the general threat 
conditions across a risk spectrum, HSPD-3 directs Federal agencies and departments to develop 
and implement protective measures appropriate to each threat condition. 

The general HSAS guidelines for protective measures that Federal 
departments and agencies should consider under condition Orange, 
or “High Risk of Terrorist Attacks,” include the following: 

• coordinate necessary security efforts with Federal, Slate, and 
local law enforcement agencies or any National Guard or 
other appropriate armed forces organizations; 

• take additional precautions at public events and consider 
alternative venues or cancellation if necessary: 

• prepare to execute contingency procedures, such as moving 
to an alternate site or dispersing their workforce; and 

• restrict threatened facility access to essential personnel only. 

The general HSAS guidelines for protective measures that Federal 
agencies should consider under condition Red, or "Severe Risk of 
Terrorist Attacks” include the following: 

• increase or redirect personnel to address critical emergency needs: 

• assign emergency response personnel and preposition and mobilize specially trained 
teams or resources; 

• monitor, redirect, or constrain transportation systems; and 

• close public and government facilities. 

The HSAS is only binding for the executive branch of the Federal government. HSPD-3 does, 
however, encourage governors, mayors, and other leaders to review their organizations and 
assign protective measures to the threat conditions in a manner consistent with that of the Federal 
government. Some State and local governments have adopted threat advisory systems based on 
the HSAS, with specific security measures to be implemented under each of the color codes. 
Both Connecticut and New Jersey have a threat alert sy.stem that is coordinated with the 
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HSAS.^'^ State and local governments can raise their threat conditions independent of the 
Federal government. 

C. Reconstruction 

The T3 FSE did not have scripted elevations of the HSAS or State threat conditions, The 
exercise began with the HSAS and participating State (New Jersey and Connecticut) advisory 
systems at Yellow (elevated). At 12:14 on Monday, April 4, 2005, the New Jersey governor, in 
consultation with the Department of Homeland Security (DHS) Secretary, raised the New Jersey 
State threat condition to Orange following a presumptive diagnosis of pneumonic plague and the 
discovery of a suspected Yersinia pestis dispersal mechanism. Later that day the governor 
enacted travel restrictions in Middlesex and Union counties, the suspected origins of the attacks. 

At 14:12 the Connecticut governor, in consultation with the DHS Secretary, raised the 
Connecticut State threat condition to Orange in response to the vehicle-borne improvised 
explosive device (VBIED) and chemical mustard attacks in New London.. At 17:00, the DHS 
Secretary announced the elevation of the HSAS to Orange nationwide and to Red in Middlesex 
and Union Counties, New Jersey. 

At 14:05 on April 5. 2005, the New Jersey governor announced that he was raising the New 
Jersey State threat condition to Red for the entire State. He issued an order restricting travel to 
"persons seeking essential medical care, residents traveling to prophylaxis Points of Dispensing 
(PODs), and essential public and private sector personnel and those people returning home,” in 
part to facilitate movement of emergency responders. The order and accompanying press release 
stated: 

Essential personnel for the purposes of this emergency shall include, but 
not be limited to the following: State employees bearing State 
identification designating them as essential employees for the purpose of 
traveling during this emergency. New Jersey Transit employees, utility 
contractors, hospital and nursing home personnel, and others providing 
emergency services or support to those adversely affected by this 
emergency. 

On the evening of April 5, the DHS Secretary raised the HSAS to Red for the State of New 
Jersey. He considered raising the HSAS to Red for the State of Connecticut as well, but the 
Connecticut governor convinced him that it might only hinder response efforts. 

Over the next two days (April 6 and 7), DHS, IIMG, and New Jersey officials discussed 
removing the travel restrictions and lowering the HSAS and the State threat conditions for New 
Jersey. The New Jersey State Emergency Operations Center (EOC) announced that the travel 


' New Jersey website http://www.njhomelandsecurity.coin/. 

"Connecticut website http://www .ct.gov/hls/cwp/view. a.sp?a=1030&q=255220#Yellow 
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restrictions were lifted at 10:30 on April 6. However, many Federal agencies remained unclear 
for several hours about whether the restrictions were still in effect. Late on April 7. DHS and the 
State of New Jersey began coordinating a joint press release announcing reduction of the State 
threat condition and the HSAS from Red to Orange. This press release was issued on April 8. 
When the T3 FSE concluded midday on April 8, both Connecticut and New Jersey were at State 
and Federal HSAS levels Orange. The remainder of the country also stayed at Orange. Figure I-l 
shows the HSAS threat condition timeline. 

Figure I-L HSAS Threat Condition Timeline 
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D. Analysis 

HSPD-3 states that the HSAS was created to serve two primary purposes. First, it is intended to 
inform Federal, State, and local governments and the public of the perceived credibility and 
imminence of threats. Second, it is intended to direct a systematic, coordinated governmental 
response to such threats to "reduce vulnerability or increase response capability.” For example. 
HSPD-3 states that Federal departments/agencies should consider "monitoring, redirecting, or 
constraining transportation system.s” under a Red threat condition (which could reduce 
vulnerability) and consider ‘“prepositioning and mobilizing specially trained teams or resources” 
(which would increase response capability). 

Although implementation of the HSAS has evolved and become more nuanced. it does not 
necessarily serve either of these purposes effectively, as evidenced by the issues observed in the 
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T3 FSE. Further, these purposes could be in conflict at times, as was observed in SOE 04-4, 
Crimson Dawn, as well as during the T3 FSE. In the nearly three years since it was created, FSL 
government agencies and the public have become accustomed to the system, but implementation 
of the HSAS and associated protective measures is still not systematic. Issues/observations from 
the T3 FSE are discussed below. 

I. Lack of Systematic Implementation of the HSAS 

An examination of the conditions under which, and how, the Orange and Red HSAS threat 
conditions have been used in real-world and exercise elevations reveals that although some 
patterns in its usage are emerging, its implementation is still not systematic. This may contribute 
to varying perceptions and interpretations of the threat levels. 

DHS has varied in its approach to the HSAS Red threat condition in response to mock 
chemical/radiological attacks. In the T2 FSE, the first FSE after the creation of the HSAS, the 
DHS Secretary notionally elevated it to Red for the city of Seattle in response to the radiological 
dispersal device (RDD) blast. In the T3 CPX, DHS elevated the HSAS to Red for the States that 
were affected by chemical attacks. During the T3 FSE, the Secretary proposed elevating the State 
of Connecticut to Red in respon.se to the notional VBIED blasts and chemical attacks; however, 
he did not do so in deference to the governor’s request. 

There has been more commonality in usage of the HSAS in response to biological attacks, In the 
T2 FSE, the level was elevated to Red for the city of Chicago in response to the mock biological 
attack, along with six other high-risk (based on the mock intelligence) cities in the second day of 
the exercise, but no State was elevated to Red. On Day One of the T3 FSE, the Secretary of DHS 
elevated the HSAS to Red for the two counties most directly affected by the biological attack in 
New Jersey and extended it the next day to the entire State. 

In the T2 FSE, the Secretary ultimately elevated the nation’s threat level to Red for a period of 
two days to prevent additional terrorist attacks. In contrast to each of these past exercises, 
participants in the four SOEs that preceded the FSE — one of which (SOE 04-4, Crimson Dawn) 
was dedicated to examining the HSAS — indicated they would not recommend raising the HSAS 
to Red even after two coordinated terrorist attacks.^ One pattern across these exercises suggests 
that DHS would not likely elevate the HSAS to Red on a preattack basis. 

Some of the inconsistencies in these exercises are due to changing leadership and relative 
newness of the system (despite growing real-world experience with Orange elevations, many 
recent ones have taken different, tailored forms and the exercise-oriented Red elevations have 
been experimental in nature). Even the former Deputy Secretary of DHS, Admiral James Loy 
observed in congressional testimony that the HSAS has evolved to the point where “today’s 
Yellow is yesterday’s Orange.” As discussed later in this section, some of this may also be due to 


' SOE 04-4, 05-3 and 2 
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the fact that protective measures for the Red threat condition have not yet been fully defined and 
their implications are not fully understood.^ 

Interpretation of the very general HSAS guidelines has been evolving with experience. Further 
consideration regarding the purpose and desired implications (beyond symbolic) of the HSAS is 
needed. Policymakers should examine the growing body of data on officials’ perceptions of the 
HSAS and how it is applied to inform any changes to HSPD-3. 

2. Lack of Formal Mechanism for HSAS 

Over the course of seven real-world elevations of the HSAS to Orange. DHS has enhanced its 
high-level protocols for coordinating changes to HSAS threat conditions with State and local 
governments. A March 2004 General Accounting Office (GAO) report highlighted the various 
means by which DHS communicates threat level changes to Federal, State, and local government 
and private sector leaders, including conference calls from the Secretary of DHS to governors, 
mayors, and CEOs; e-mails; and coordination through the Homeland Security Operations Center 
(HSOC) and DHS Office of State and Local Government Coordination and Preparedness 
(SLGCP).’ 

In the T3 FSE, DHS coordinated directly with top officials from State and local governments on 
HSAS threat level changes. When DHS raised the HSAS threat condition to Orange. SLGCP 
contacted State homeland security advisors regarding the Federal HSAS change approximately 
20 minutes prior to the change taking effect and approximately 40 minutes before the Secretary’s 
press announcement. The elevation of the HSAS threat condition was widely disseminated 
within the Federal government and State EOCs prior to the announcement on VNN. When DHS 
raised the Federal HSAS threat condition to Red for the Stale of New Jersey, top officials 
coordinated with the New Jersey governor and the New Jersey State homeland security advisor. 
DHS and State top officials held conference calls to discuss lowering the HSAS and State threat 
conditions in New Jersey to Orange, and many agencies over several days reported discussing 
the changes and their potential effects.* 

Coordination of the threat condition changes at the highest levels of the State and Federal 
government did not always translate to smooth coordination and understanding at the staff levels. 
There appeared to be no uniform method or process for transmitting the decisions on the HSAS 
and State threat levels to State and Federal agencies (and the private sector). In the T3 FSE, this 
caused some organizations to be unaware that the HSAS had changed, uncertain as to whether 
associated State threat conditions had also changed, and/or uncertain as to the status of either 


* See also SOE 04-4 After-Action Report. 

^ U.S. General Accounting Office. Risk Communication Principles May Assist in Refinement of the Homeland 
Security Advisory System, (Washington, D.C.: Mar 16, 2005), http://www.gao.gov/new.items/d04538t, pdf. 

* Data did not provide insight into specific effects of threat level changes that agencies discussed. 
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threat condition. For example, different agencies in New Jersey reported different threat 
conditions at the same time or incorrectly reported that the entire State had been elevated to Red, 
though it was only Middlesex and Union Counties. T3 FSE data have similar examples of 
incorrect notification or reporting of threat conditions among Federal agencies, between Federal 
and State agencies, and within Stales among State agencies. 

Some of the misunderstandings may have been due to the similarities between State systems and 
the HSAS. The participating States in the T3 FSE use terminology similar to the HSAS: 
Connecticut’s system is referred to as the “Homeland Security Threat Level,” and New Jersey’s 
language and color-coded levels are identical to the HSAS. This further underscores the 
importance of formal notifications that clearly identify which threat condition (HSAS, State, or 
local) is being elevated and by whom. Formal notification is especially important with the more 
tailored elevations of the HSAS threat condition to a specific region or sector. Also, without a 
formal notification process, it can be difficult to distinguish between authoritative decisions and 
unconfirmed advance notices, further contributing to misunderstandings. 

Misunderstandings on the status of HSAS and State threat conditions due to the absence of 
formal notification procedures were observed in the T2 FSE (May 2003) and the T3 CPX (May 
2004). In a February 2004 GAO report that examined real-world elevations to Orange, it was 
noted that DHS had not formally documented notification protocols for alerting FSL government 
departments/agencies of changes to HSAS threat levels^. Although notification protocols have 
improved considerably over the past two years, 
more detailed notification protocols at FSL levels 
regarding the status and implications of the various 
threat advisories could be helpful. 

The T3 FSE data suggest that the protective 
measures that were implemented (notionally) under 
the HSAS and State threat conditions of Red were 
not uniformly tracked. Some Federal agencies 
generally reported implementing protective 
measures at HSAS threat conditions of Orange and 
Red, but most did not provide a list of specific 
protective measures. The Interagency Incident Management Group (IlMG) reviewed candidate 
Federal protective measures in their deliberations related to the HSAS, but the data do not 
identify which were implemented, with the exception of the transportation sector. 

The DHS Protective Security Division developed a set of recommended protective measures for 
the private sector'® and passed them to the IlMG. But no listing could be found as to which, if 


'The cornerstone of the HSAS is 
the protective measures that are 
implemented at each Threat 
Condition." 

Testimony of DHS Deputy Seaetary James 
Loy ADM. USCC (RET). Before the House 
Selea Committee on Homeland Security 
"The HSAS: Improving Preparedness through 
Effective Warning" February 4. 2004 


U.S. General Accounting Office. Homeland Security Advisory System: Preliminary Obserwtions Regarding 
Threat Level Increases from Yellow to Orange, GAO-04-453R (Washington, D.C.: Feb. 26. 2004). 

For critical infrastructure for specific sectors (e.g., energy). 
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any, were implemented in elevations of the HSAS threat condition. Also, there was no evidence 
from the data collected at the National Infrastructure Coordinating Center (NICC) that the 
private sector participants received these recommended protective measures prior to or during 
the FSE. Although there were instances of collaboration on individual protective measures (such 
as travel restrictions), there did not appear to be an overarching mechanism for coordinating 
implementation of FSL and private sector measures. 

The transportation sector provided the most comprehensive record of which protective measures 
were implemented. For example, the Federal Aviation Administration (FAA) implemented 
Temporary Flight Restrictions (TFRs) for the airports in the incident regions. The U.S, Coast 
Guard (USCG) elevated their Maritime Security (MARSEC)" levels in the affected areas 
consistent with HSAS elevations. The State of New Jersey also provided data on its 
highway/roadway travel restrictions. 

At the local level. Union County, NJ'" initiated the following protective measures in response to 
the elevation of the HSAS and State threat conditions to Red; 

• closed all schools; 

• closed all government offices; 

• announced that only essential personnel needed to respond to threat; 

• cancelled all major events; 

• closed businesses (except for grocery stores); 

• initialed Buffer Zone Protection Plans; 

• maintained contact with hospital and health officials; and 

• initiated travel restrictions. 

But even those protective measures that were widely communicated were often incorrectly 
reported or misunderstood due to the absence of a formal mechanism for coordinating and 
tracking implementation. For example, the USCG implemented MARSEC ll'^ in Boston, New 
York/New Jersey, Trenton, and Philadelphia, and MARSEC III in Bridgeport, New London, 


" hltp://www. uscg.mil/dl7/msojuneau/facsec/faciIity _security_requirenients.htm. There are three MARSEC levels 
that are aligned with the HSAS threat condition color codes. MARSEC 1 aligns with HSAS Green. Blue, and 
Yellow with normal security measures to minimize vulnerability to incidents. MARSEC II has additional 
protective measures that are expected to be sustained for substantial periods of time and aligns with Orange. 
MARSEC III aligns with Red with even more protective measures; however, these protective measures, and 
therefore MARSEC III, are not intended to be sustained for substantial periods. 

Similar measures were reported for Middlesex County. However, the reports of those measures associated them 
with a state of emergency instead of an elevation in the threat condition. 

"Under MARSEC II, access to port facilities is controlled and 25 percent of pedestrians, baggage, and personnel 
effects are screened. MARSEC 111 includes the protective measures under MARSEC II, 50 percent of vehicles are 
screened, and 1 00 percent of large vehicles are screened. MARSEC 111 does not mean automatic closure of the 
port, but can include port closure. 
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New Haven, and Long Island Sound in Connecticut.''^ Some agencies erroneously reported the 
“ports” of New York and New Jersey as closed when they were not.'^ 

Similar misunderstandings occurred with airports. The Department of Transportation (USDOT) 
reported the airports in New York and New Jersey as open and operating throughout the 
exercise. It asked air carriers to voluntarily cancel flights into affected airports, and many 
international flights were redirected to other airports primarily in Philadelphia, Boston, and 
Baltimore. Yet, many FSL agencies were confused regarding the status of the airports and 
repeatedly asked if the airports were closed, or mistakenly reported them as closed. 

3. Lack of Formal Coordination Mechanism 

In the T3 FSE, there did not appear to be a formal mechanism for coordinating and tracking the 
implementation of FSL and private sector protective measures. This may have contributed to the 
inconsistent application of some measures in the T3 FSE. For example, when New Jersey 
elevated the State threat level to Red, highway travel in and around the State was restricted to 
essential emergency personnel and supplies to facilitate response and prevent the spread of 
plague. However, even after DHS elevated the HSAS threat level to Red for the State, the 
airports and ports in New Jersey remained open. This could have been problematic for a number 
of reasons. Under this arrangement, passengers and cargo were permitted to arrive in New Jersey 
by ship or plane, but not permitted to leave the airport or port facility. It could also have resulted 
in conflicting messages to the public. 

In addition, little guidance was provided regarding what constituted “essential” in these cases. 
Some EOC personnel in New Jersey expressed concern that the restrictions might apply to their 
personnel, and that they would therefore be unable to report to the EOC. There is no evidence 
that instructions were provided to New Jersey State Troopers or local police on how to identify 
authorized travelers. Further, there is also no evidence that essential medical or other personnel 
outside the State of New Jersey were provided with instructions regarding the credentialing they 
would need to cross the State border and travel unimpeded while the travel restrictions were in 
effect. 

The Lead Sector Coordinator for the Healthcare Sector in the DHS Infrastructure Coordination 
Division believed implementation of movement restrictions could apply to transport of food and 
water, which could have had an immediate and significant impact on healthcare operations in 
New Jersey by delaying deliveries.'^ Additionally, the re,strictions on interstate road travel could 


Long Island Sound is located north of Long Island and south of Connecticut and Rhode Island. The entrances to 
the Port Authority of New York/New Jersey are south of Long Island. 

No further details were provided. 

Dale Brown Lead Sector Coordinator. Healthcare and Public Health Infrastructure Coordination Division. DHS. 
Impacts of the shift to RED on the Public Health and Healthcare Sector, memo written during T3 and posted on 
JFONET. Undated. 
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have caused severe traffic congestion along the entire East Coast as traffic was diverted around 
the State of New Jersey, a major passenger and freight thoroughfare. Without more 
comprehensive and coordinated implementation planning, these restrictions, which were 
intended to facilitate response efforts, could have severely hampered movement of necessities 
into the State. 

4. Unintended Consequences ofHSAS Red 

The T3 FSE revealed differing views on whether an HSAS and/or State Red threat condition 
would help or hinder response. In the SOEs that preceded the T3 FSE. officials who were 
reluctant to elevate the HSAS to Red mentioned these concerns frequently. As mentioned earlier, 
the New Jersey governor believed an elevation of the HSAS and State threat conditions to Red 
would help response efforts, whereas the Connecticut governor was concerned that this threat 
condition would hinder response efforts. The DHS Lead Sector Coordinator for the Healthcare 
Sector (Infrastructure Coordination Division) was concerned that the increased security checks 
and patrols implemented under the elevation of the HSAS and State threat conditions to Red 
could hinder response. For example, healthcare facilities (such as in-patient care sites other than 
hospitals) are encouraged to escort contract personnel, increase security patrols, and place guards 
at entries under an HSAS Red threat condition. But these requirements could necessitate 
additional security personnel who are already overburdened by other response needs. The data 
from the T3 FSE did not indicate whether these security measures were even notionally 
implemented. However, even if they were implemented notionally, the personnel requirements of 
these security measures were not likely fully recognized. DHS and FAA staff expressed concern 
that the TFRs imposed over New London, CT, and New Jersey would hamper relief efforts, 
though the data did not provide insights into their specific concerns. 

Discussions by officials at the IIMG expressed concern that extended periods of time with Red 
protective measures implemented could have negative economic and psychological impacts on 
the northeast region, and ultimately hamper response efforts. DHS officials worked with the 
State of New Jersey to reduce and eliminate travel restrictions that would negatively affect the 
response efforts. Later, the IIMG reviewed Federal Red protective measures and determined that 
it was not Federal measures that were hindering response activities. They determined that 
lowering the threat advisory to Orange, while maintaining certain Red protective measures, 
would not increase the vulnerability to attack.*’ 

Because few of the HSAS Red protective measures that would be implemented were shared 
across FSL government agencies, and the private sector and implementation of all of the Red 
protective measures were notional, it is not possible to assess their full impact on the response 
efforts. But, the T3 FSE demonstrated that some protective measures intended to facilitate 
response could potentially hamper response and that more implementation planning and 


The data did not provide insight into what specific Red protective measures the IIMG felt could be maintained to 
enhance security and which could be terminated. 


UNCLASSIFIED - F OUO 

This Document Contains Canadian and United Kingdom Information 

69 





AAR 


FO R OFF I CIAL USE ONLY 


TOPOFF 3 


coordination for any extreme protective measures — especially those related to passenger or 
freight transportation — would be critical to minimizing unintended (and unanticipated) 
consequences. The T3 FSE also demonstrated that a better understanding of the ripple effects of 
extreme protective measures is needed. SOE 04-4. Crimson Dawn, made similar 
recommendations to better understand the consequences of extreme protective measures. 

5. USAS Used as a Means to Facilitate Emergency Response Operations 

There was a notable difference in the use of the HSAS and State homeland security advisory 
systems in the T3 FSE from previous exercises. This difference involved the conscious use of 
Red threat conditions by top officials to facilitate emergency response operations, both in terms 
of operational coordination and movement. Most of the discussions regarding elevating the 
HSAS and/or State threat conditions to Red — or downgrading to Orange from Red — focused 
primarily on these aspects and less on the threat of an imminent attack. This focus is not 
inconsistent with HSPD-3, which states that the purpose of the HSAS is “to reduce vulnerability 
or increase response capability.” But, it is noteworthy because in other exercises and in real- 
world applications of the HSAS to date, the focus has been primarily on the threat alert and 
prevention aspects. 

6. Inconsistent Messages and Little Specific Guidance 

In the T3 FSE, the elevated HSAS and State threat conditions did not serve as a particularly 
informative warning or risk communication tool for the public. By elevating the threat conditions 
after the attacks (even to Orange), the use of the HSAS as a warning tool communicated little to 
the public that it didn’t already know (that the United States had been attacked and was possibly 
at higher risk for additional attacks). Little information was provided to the public in terms of 
protective action guidance specifically related to the HSAS and State Threat Level elevations. 
Also, the HSAS was elevated to Red in New Jersey as a response to the presumed biological 
attacks, but only to Orange in Connecticut after the VBIED- and covert-airplane-dispersed 
chemical attacks on New London.'* No explanation was provided as to why residents in 
Connecticut were at less risk than those in New Jersey. 

Other authorities, granted by such declarations as the State of Emergency and the Federal 
disaster declaration, as well as a Public Health Emergency in New Jersey, allowed the flow of 
resources and implementation of protective measures to facilitate response. These activities 
would have likely conveyed the message that FSL government agencies were actively 
coordinating response measures. Further, the protective action guidance that was issued in both 
venues (In New London, CT, residents were instructed to shelter in place to prevent/minimize 
exposure to the chemical attacks and New Jersey residents were advised to seek prophylaxis 
treatment in response to the plague outbreak) was not directly related to the HSAS. For these 


The DHS Secretary wanted to elevate the State of Connecticut to Red, as well as New Jersey, but was persuaded 
not to take this action by the governor who wa.s opposed to it out of concern that it would hinder response. 
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reasons, the use of the HSAS in the T3 FSE appeared redundant. This, coupled with some of the 
misunderstandings by officials and the media regarding the status of various threat conditions, 
could have complicated rather than simplified the public message. 

The DHS Secretary did provide some examples of specific protective measures that the Federal 
government was taking in the initial elevation of the HSAS to Red in New Jersey. This was in 
contrast to the T2 FSE, in which little to no information was provided to the public on the HSAS 
elevations to Red. He also referenced "hundreds” of measures routinely taken at Orange, which, 
although nonspecific, would have likely fostered a perception that the Federal government is 
acting in a proactive and focused manner to protect the public. This introduction of the Red 
threat condition to the public represented a marked improvement from previous exercises in 
which very little information had been given regarding the definition of the “Severe” threat 
condition. Efforts have also been made to increase the guidance available to the public regarding 
the HSAS. For example, DHS. with input from the American Red Cross (ARC), has developed 
“Citizen Guidance on the Homeland Security Advisory System” and has sponsored Ready.gov, 
among other public awareness initiatives.'^ But, public guidance related to specific HSAS 
elevations still remains rather general for a variety of reasons, including national security 
concerns (not wanting to tip off the terrorists) and the lack of uniform procedures for 
coordinating and tracking implementation of specific protective measures. 

Discussions among Federal and State top officials during the T3 FSE regarding elevating the 
HSAS to Red suggested that the public waming/advisory aspect of the HSAS is heavily 
considered in decisions to elevate the HSAS. but that the possible effects of a Red threat 
condition are not well, or at least not consistently, understood. For example, the HSAS and State 
threat conditions in New Jersey were elevated to Red and highway/roadway travel restrictions 
were implemented into, within, and out of the Stale of New Jersey in the belief (at least in part) 
they would help facilitate response to the biological attack. In contrast, the Connecticut 
governor requested that DHS not elevate the HSAS to Red for any part of Connecticut out of 
concern that some of the protective measures could hinder response efforts.^' The Connecticut 
governor expressed concern that negative consequences of elevating the HSAS to Red would 
outweigh the benefits. The Secretary of DHS expressed his belief that elevating the HSAS to Red 
in response to the attacks was important from a “public perception” standpoint, but deferred to 
the Connecticut governor’s wishes to leave the State’s HSAS at Orange.^^ 

When New Jersey and DHS officials discussed lowering the HSAS and State threat conditions 
from Red to Orange before prophylaxis operations were completed, the New Jersey governor 


htip://www .dhs.gov/interweb/assetlibrary /CitizenGuidanceHS AS2.pdf 
New Jersey Governor FYess Release. 20:46, April .‘5, 2005. 

The data did not provide insight on the governor’s specific concerns. 

^ No additional or amplifying information was provided. 
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expressed concern that lowering the threat conditions would send the wrong message to the 
public. He feared that the public would believe that the threat was over and those who had not 
yet been prophylaxed would not report to the PODs. Recent SOEs, particularly SOE 04-4, 
revealed a similar emphasis on the {positive or negative) public perception of an HSAS Red 
threat condition and that the implications of a Red threat condition are not well understood. 
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7. Issues from Previous Exercises 

Table I-l depicts the significant exercise decisions and issues/observations since the T2 FSE that 
are related to the HSAS and State threat advisory systems, with special focus on elevations of the 
threat condition to Red.“^ 

Table /■/. Comparison ofT3 FSE with Previous Exercises 


T2 FSE 

T3 CPX 

SOEs 05-2 and 05-3 

T3FSE 

SIGNIFICANT DECISIONS 

1 

• Affected local 
jurisdictions in, 

Washington State 
elevated their threat 
conditions to Red 
Immediately after ROD 
blast. 

• DHS elevated the HSAS to 
Red for Seattle that 
afternoon. 

• DHS elevated the HSAS to 
Red tor seven cities late 
that evening. 

• DHS elevated the HSAS to 
Red nationwide the next 
day In response to both 
the ROD and biological 
attacks. 

• DHS Instituted a regional 
elevation of the HSAS to 
Orange from Boston, MA, 
to NoHotk.VA, In 
response to intelligence 
suggesting an imminent 
attack. 

• DHS elevated the HSAS 
to Orange nationwide 
and Red in selected 
slates after simultaneous 
chemical attacks in CT 
and NJ. 

• OHS lowered the selected 
Red Stales to Orange and 
nation remained at 

Orange after all suspects 
were in custody. 

• Interagency decision 
makers expressed 
consistent reluctance to 
elevate the HSAS to Red, 
even in the aftermath of 
attacks — primarily due to 
concerns regarding 
unintended 
consequences. 

• Some Slate participants 
expected their State threat 
advisory system might be 
elevated to Red in the 
event of a compelling 
threat of, or In response 
to, an attack. 

• Affected governors 
elevated their State threat 
conditions to Orange 
shortly after the 
biological (NJ) and 
chemical (CT) attacks, 
and after coordinating the 
elevation with DHS. 

• OHS elevated the HSAS 
to Orange tor the nation 
and Red for the two 
counties In NJ suspected 
of being the epicenters of 
the biological attacks. 

> On afternoon of 0+1, NJ 
governor elevated State 
threat condition to Red 
tor all counties. 

• In the evening of D+1, 

DHS elevated HSAS to 

Red for all of NJ. 

» On 0+3, DHS lowered 

HSAS In NJ to Orange. 

ISSUES/OBSERVATIONS 

• Agencies do not have or 
share consistent 
understanding of formal 
notification approaches 
for HSAS status changes. i 

• There was widespread 
uncertainty as to the 

HSAS status until the 
nationwide alert on D^-l. 


• The IIMG, SLQCP, and 
personal phone calls from 
the Secretary of DHS to 
governors/mayors are 
three mechanisms by 
which HSAS threat 
changes would be 
coordinated with 

Slate/loeal governments. 

• Coordination of HSAS 
status changes occurred 
at the highest levels. 

This did not translato into 
smooth coordination 
among operations centers. 

1 




1 

1 

• The absence of a . 

mechanism for ' 

coordinating the j 

Implementation of 
srotectlve measures 1 



w 

• There did not appear to 
be a formal mechanism 
for coordinating, 
reporting, and tracking 
HSAS and State threat 


Issues are depicted in red font; observations in black, and improvemenLs/good practices in green. 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

73 




AAR 


TOPOFF 3 


T2 FSE 

T3CPX 

SOEs 05-2 and 05-3 

T3 FSE 

across Federal, State, and 
local governments and 
private sector can 
contribute to an 
uncoordinated response. 



level changes and 
Implementation of 
associated Federal, State, 
local, and private sector 
protective measures. 

• The absence of a 
mechanism for 
coordinating the 
Implementation of 
protective measures 
contributed to an 
uncoordinated response. 

• Increased coordination Is 
needed between DHS and 
States/iocalitles on nature 
of threats in order to 
minimize unintended 
consequences and cost* 
effectively Increase the 
overall protective 
posture. 


• Consequences of HSAS 
and State Red-level threat 
conditions are not well 
understood. 

► 

• Unintended 
consequences of 
impiemenilng HSAS Red 
protective measures were 
not well understood. 





• Public information 
messages regarding 

HSAS elevations should 
be clear, consistent, and 
explain comprehensive 
Federal, Slate, and local 
response actions, as well 
as recommended actions 
for the general public. 


• Public Affairs participants 
emphasized the need lor 
consistent messaging and 
specific guidance. 

w 

• Inconsistent messages 
and little specific public 
guidance limited the 
value of the HSAS as a 
warnlng/advlsory 
system. 




• Observation of real- 
world and exercise 
elevations of the HSAS 
revealed that Its 
Implementation was 
not systematic. 

» Officials used the 

HSAS and State 
homeland security 
advisory systems to 
facilitate emergency 
response operations 
more than as threat 
advisory systems. 


• Decision makers 
experimented with 
"Orange Plus" 
terminology In CPX to 
refer to a level of Orange 
with selected Red 
protective measures but 
have since abandoned this 
language. 

• Decision makers 
expressed concern over 
how to define the 
conditions under which it 
would be acceptable to 
lower the HSAS from Red 
and the mechanics for 
doing this. 
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E. Conclusions 

There was a notable difference in the use of the HSAS and State homeland security advisory 
systems in the T3 FSE from previous exercises. This difference involved the conscious use of 
Red threat conditions by top officials to facilitate emergency response operations, both in terms 
of operational coordination and movement. Most of the discussions regarding elevating the 
HSAS and/or State threat conditions to Red — or downgrading to Orange from Red — focused 
primarily on these aspects and less on the threat of an imminent attack. The effects on response 
efforts of raising the HSAS to Red after an attack are unknown, and are tied directly to the 
specific protective measures that are implemented, as well as how they are implemented. 
Improved protocols for coordinating and tracking implementation of protective measures — 
particularly severe protective measures — are needed. 

A noteworthy element of the exercise was the increased emphasis on, and influence of, the 
public waming/advisory element of the HSAS in decisions to elevate or lower the threat 
condition. More consistent and clear messages are needed to fulfill this purpose of the HSAS. 
Citing other authorities, such as declarations of states of emergencies, in messages related to 
emergency response actions — rather than the HSAS — could also clarify the public messaging by 
delineating between actions taken to facilitate response and those taken to address a threat and 
reduce vulnerabilities. 

Efforts are currently underway with Congress and DHS to review the current purpose and 
implementation of the HSAS. If the HSAS is retained, substantially more consideration should 
be given to making it a more robust, but still highly flexible, system that can more effectively 
serve its two primary purposes of advising/alerting FSL governments, the private sector, and the 
public to potential threats, and reducing vulnerability to those threats. 

I. Recommended Courses of Action 

• Develop a formal process for coordinating and tracking implementation of severe (or 
Red-level) protective measures across Federal, State, and local governmental agencies and 
the private sector. Build a database of measures by threat and agency to help top officials 
select the measures best aligned with a given scenario. 

• Provide more specific guidance regarding actions recommended under the different 
color-coded threat conditions and link the levels to specific protective measures. 

• Re-examine and refine the potential purposes of the HSAS: 

o public warning and advisory; 
o attack prevention; and 
o emergency response. 

There may be value in further narrowing and better focusing the purpose of the HSAS to one of 
these and using means outside of the HSAS to achieve the other purposes, as these can inherently 
conflict in some cases. Specifically, use of the HSAS should be examined as a means to facilitate 
response. Although HSPD-3 states that one of its purposes is to enhance response, elevating the 
HSAS and related State systems after an attack specifically to facilitate response takes the focus 
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away from their primary role as risk communication and prevention systems, and may 
complicate emergency response messages. Declarations of States of Emergency, the Stafford 
Act, the Public Health Service Act, and other emergency powers granted to Federal. State, and 
local top officials are also associated with facilitating response. 

II. Joint Field Office (JFO) Operations 

A. Introduction 

The T3 Full-Scale Exercise (FSE) provided an opportunity to exercise the recently codified JFO 
concept and identify issues that could impede its ability to support emergency response 
operations. The events in Connecticut and New Jersey prompted Federal officials to activate 
JFOs and select Principal Federal Officials (PFOs) for both States. During the exercise, the JFO 
and PFO staffs focused their efforts on integrating the Federal and State responses efforts by 
arranging resource support, coordinating response policies and operations, and sharing 
information. 

Observations made during the exerci.se indicate 
that JFO operations were problematic in both 
States. Two kinds of disconnects were observed. 

First, the JFO staff encountered problems 
coordinating their activities and support with 
State officials. Second, the JFO staff also had 
trouble coordinating the activities of the JFO 
staff elements. These internal issues are the 
focus of this section of the report. The external 
coordination issues that existed between the JFO 
and State organizations are addressed in detail in 
other sections of this report that cover points of 
dispensing (PODs), resources, and information 
sharing. This section focuses on identifying the 
structural and process issues that adversely 
affected JFO operations during the T3 FSE. The 
issues included the following: 

• unclear lines of authority within the JFO; 

• undefined roles and responsibilities in the PFO cell; and 

• a lack of implemented processes for sharing information. 

Resolving the internal structural and process issues would ultimately strengthen the JFO’s ability 
to coordinate Federal and State response efforts. 


SiiMMARV OF Conclusions: 

JFO Opkrations 

• Lines of authority and coordination among ihe 
PFO. FCO. and JFO seccion.s were unclear and 
hampered unity of effort with the JFOs in both 
Connecticut and New Jersey. 

• The relationship between the PFO and FCO is not 
formalized, and final authority over the JFO cell 
was unclear. 

• In Connecticut, the PFO cell duplicated much of 
the capabilities and expertise re.sidcnt in Ihe JFO 
sections, but it lacked its own clear purpose or 
delineated responsibilities. This often resulted in 
overlapping or competing activities occurring in 
the PFO cell and the JFO section. 

• The JFOs did not follow standard processes for 
sharing information internally. 
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B. Background 

The JFO is a temporary facility established locally to coordinate Federal assistance during an 
incident of national significance. Through the JFO, the Federal government provides a central 
coordination site for Federal, State, and local response efforts.^'’ 

1. Structure of the JFO 

The National Response Plan (NRP) divides the JFO organization into three different elements: 
The JFO Coordination Group, JFO Coordination Staff, and JFO sections. Figure 11-1 is a 
diagram of a nominal JFO organization for a terrorist incident that depicts how the three JFO 
elements are related. 

Figure II-I. Nominal JFO Organization for a Terrorist Incident 



a. JFO Coordination Group 

Within the structure set forth in the NRP. the JFO Coordination Group directs the activities of 
the JFO elements and sets the operational priorities for Federal agencies responding to the 
emergency. The JFO Coordination Group establishes priorities across incidents, resolves policy 
conflicts between agencies, and provides strategic guidance for incident management activities. 
The key members of the coordination group are the Principal Federal Official (PFO), Federal 
Coordinating Officer/Federal Resource Coordinator (FCO/FRC), and State Coordinating Officer 
(SCO). In a terrorist incident, the Federal Bureau of Investigation (FBI) Special Agent-in-Charge 


National Response Plan (December 2{X)4). 
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(SAC), as the Senior Law Enforcement Official, is also a member of the JFO Coordination 
Group. Other senior Federal officials (SFOs) representing agencies with primary jurisdictional 
responsibility for some element of the response may also join the group as required. The primary 
responsibilities of each JFO Coordination Group member are as follows: 

• The PFO represents the Secretary of Homeland Security in the field and coordinates the 
overall Federal response. 

• The SAC coordinates criminal investigations and law enforcement activities associated 
with the incident. 

• The FCO manages and coordinates the Federal resource support provided through the 
Stafford Act. 

• The SCO represents the State in the Federal resourcing process by approving State 
requests for Federal resources provided during the response (e.g., a State may be 
responsible for 25% of the deployment costs for a disaster medical assistance team). 

• SFOs assist in the management of the Federal response as the most senior representatives 
of their agencies. 

b. JFO Coordination Staff 

The JFO Coordination Staff supports and advises the officials in the JFO Coordination Group. 
Typical JFO Coordination Staff positions include a Chief of Staff, Safety Coordinator, Legal 
Affairs, Equal Rights Officer, Security Officer, External Affairs Officer, Defense Coordinating 
Officer (DCO), and various liaisons as needed. The JFO Coordination Group selects the 
personnel who fill the JFO Coordination Staff positions and relies on their subject-matter 
expertise to inform decisions made by the JFO leadership. 

c. PFO Cell 

In addition to the JFO Coordination Group and Staff, there is additional staff that directly 
supports the PFO — the PFO cell. This cell does not appear on the NRP organizational diagram, 
though it is referenced in the Interagency Integrated Standard Operating Procedures for JFO 
Activation and Operations}^ The PFO cell is intended to be a small team of subject-matter 
experts from various Department of Homeland Security (DHS) components and Federal agencies 
that may be activated and deployed to provide initial support for the PFO prior to the activation 
of the full JFO. The PFO cell is designed to function primarily during the preincident phase or 
the initial response; once a JFO is established, the PFO retains a limited number of staff persons 
to support scheduling, media relations, and other PFO responsibilities. The remaining members 
of the PFO cell are reassigned into the JFO Coordination Staff and JFO sections. 


Interagency Integrated Standard Operating Procedures: Joint Field Office Activation and Operations, Version 
6.0, Approved 14 April 2005. This SOP was in draft form during the exercise itself, and had not been widely 
distributed. 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

78 





AAR 


FO R OFF I CIAL USE ONLY 


TOPOFF 3 


d. JFO Sections 

The remainder of the JFO is organized into four sections: operations, planning, logistics, and 
finance/administration. The NRP defines an area of responsibility for each section as follows: 

• Operations coordinates the bulk of the incident management support provided by Federal 
agencies to the State and local agencies. 

• Planning collects, evaluates, and disseminates situational information and develops plans 
based on this information. 

• Logistics manages logistical support for the JFO and other field locations. 

• Finance/Administration tracks Federal costs related to the incident response. 

These four JFO sections comprise the multiagency coordination center that is intended to 
accommodate the agencies essential to incident management and disaster response. Although 
most of the JFO staff represents Federal entities, local and State agencies can send 
representatives to the JFO. These four sections are commonly referred to as the JFO cell. 

In a terrorist incident response, the SAC becomes the Senior Federal Law Enforcement Official 
(SFLEO) in the JFO Coordination Group. The FBI Joint Operations Center (JOC) becomes a 
section of the JFO. 

At total of 15 emergency support functions (ESFs) provide the bulk of the staffing for the JFO 
sections. Each ESF is led by a Federal agency that is responsible for coordinating the ESF’s 
activities and identifying individuals/teams to staff the group. For example, the Department of 
Health and Human Services (HHS) is the lead coordinator for ESF-8, Public Health and Medical 
Services: this ESF is also staffed with National Disaster Medical System personnel. The ESFs 
are key resource providers during response operations. ESF staff members play a significant role 
in the mission assignment process, which is the primary method for providing Federal support to 
the State during an emergency response operation. 

2. Mission of the JFO 

The JFO supports Federal, State, and local response efforts during incidents of national 
significance. The NRP and the Interagency Integrated Standard Operating Procedures for JFO 
Activation and Operations (JFO SOP) describe the JFO’s three primary responsibilities: 

• Coordinating the response activities of Federal, State, and local entities (e.g., facilitate the 
flow of Federal resources to the affected areas). 

• Collecting and disseminating information about the crisis and the response (e.g., provide 
situation reports [SITREPs] to the Interagency Incident Management Group [IIMG]). 

• Providing a communication link between the Federal response and State/local officials 
(e.g., engage State officials on key response issues). 
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C. Reconstruction 

In response to the detection of plague in New Jersey and the release of a mustard agent in 
Connecticut, DHS activated JFOs and selected PFOs for both States. The JFOs focused on 
coordinating resources with State officials, whereas the PFO cells tracked key issues and 
assembled information about the crises. The JFO Coordination Group interacted with top 
officials from the States, set priorities for the Federal response effort, and interacted with State 
officials. The PFO cells provided the link between Federal operations in the States and the 
Homeland Security Operations Center (HSOC) and IIMG. 

The NRP calls for various parts of the JFO organization to be identified and agreed upon by the 
JFO Coordination Group; however, an artificiality of a planned exercise is that players and their 
locations were assigned prior to exercise play. Thus, the responsibility of the JFO Coordination 
Group to identify the necessary JFO participants was not fully tested in the T3 FSE. 

I. JFO and PFO Activities in Connecticut 

In response to the explosion in New London on Monday, April 4, DHS and the Federal 
Emergency Management Agency (FEMA) activated the Regional Response Coordination Center 
(RRCC) in Maynard. Massachusetts. Shortly thereafter, the FBI redesignated its New London 
Command Post as the JOC.'* At 14:20 on April 4, the FBI received approval to coordinate with 
DHS and FEMA to activate a JFO in Connecticut. The activation began with the deployment of 
the Emergency Response Team-Advanced Element (ERT-A) by the RRCC. At 16:00, the 
Secretary of Homeland Security designated a PFO in Connecticut. The PFO support staff, ERT- 
A personnel, and ESF staffers arrived at the JFO throughout the afternoon. At approximately 
20:00 on April 4, the JFO was fully stood-up and had assumed Federal incident management 
responsibility from the RRCC. Figure 11-2 depicts the organization of the Connecticut JFO. 


The New London Command Post had been established one week earlier in response to exercise intelligence 
injects. 
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Figure II-2. Organization of the Connecticut JFO 


JFO CcHirdination Group 



The Structure of the Connecticut JFO is similar to the notional JFO structure found in the NRP, 
except that the Connecticut JFO included a substantial PFO cell. 

Over the course of the exercise, the JFO Coordination Group participated in daily conference 
calls with the RRCC, Connecticut Slate Emergency Operations Center (SEOC), and governor’s 
office. The JFO Coordination Group was briefed numerous times by representatives from the 
Unified Command Post. There were also at least two conference calls between the Connecticut 
and New Jersey PFOs, as well as two additional calls between the PFO and the Secretary of 
Homeland Security. Some of these calls appear to have been an established part of the daily 
battle rhythm. In addition to daily objectives meetings, the JFO Coordination Group met as 
needed for conference calls and emerging situations. For the most part, members of this group 
were on call for meetings and conference calls throughout the day and night. 

The PFO was responsible for keeping DHS apprised of the situation in Connecticut. Part of that 
information flow process was the production of regular SITREPs. These SITREPs reported the 
actions of participating Federal, State, and local agencies. Over the course of the four-day 
exercise, the PFO forwarded six SITREPs that detailed events, activities, or findings during the 
previous operational period. The SITREPs were sent to the Secretary of Homeland Security, 
IIMG, and HSOC. Eventually the reports were also posted on the Situation Unit’s wall in the 
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JFO to improve situational awareness within the facility. Table ll-l identifies the operational 
period covered by each SITREP and the PFO's priorities or activities for that period. 

Table II-I. Summary of Connecticut PFO SITREPs 


Operational Period 

PFO Areas of Activity 

April 4, 1400-1700 

• There has been an explosion at the Port of New London with 
an estimated 132 casualties. 

• The Captain of the Port has closed the Port. 

• There is a report that this was an intentional chemical attack, 

• Connecticut requests a Stafford Act declaration. 

• The FBI is coordinating flight restrictions over New London. 

• Samples are being collected (suspected mustard agent). 

• Code orange is in effect, and a state of emergency has been 
declared. 

April 4, 1700-2200 

• There have been 1,530 casualties (107 dead). 

• Travel restrictions are in place. 

• CDC has dispatched Rapid Response Registry. 

• Evacuations have occurred near the explosion. 

• Connecticut is considering shelter-in-place strategy. 

• Federal support is being staged. 

• FBI has discovered a suspicious aircraft. 

• Connecticut Governor and PFO held a press briefing on 
VNN. 

• JFO and Joint Information Center (JIC) are stood-up. 

April 4, 2200-April 5, 0300 

• PFO continues to monitor the investigation. 

• Rescue operations continue. 

• HHS reports on available assets to support Connecticut. 

• PFO coordinating with HSOC, NJ PFO. RRCC Region 1, 
State EOC, and Defense Coordinating Officer. 

• PFO focusing on public messaging strategy with 
Connecticut. 

• PFO expects to develop decontamination strategy with the 
State. 

• PFO priority is to assess impact on transportation and critical 
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Operational Period 

PFO Areas of Activity 


infrastructure. 

• Coordinating sampling and decontamination strategies is a 
priority. 

• JFO is working with the State to clarify resource needs. 

April 5,0300-1500 

• Rescue operations continue. 

• A total of 155 people have died, and more than 6,000 people 
from Connecticut have presented at hospitals. 

• PFO is monitoring resource needs and resource deployment. 

• FBI JOC is fully activated. 

• PFO continues to focus on public messaging. 

• A priority is to coordinate consistent scientific guidance. 

• Planning for upcoming response needs is a priority. 

• Plume modeling has been received. 

April 5, 1500-2300 

• PFO cell continues to monitor casualties. 

• Investigation continues, and progress is being made. 

• Public messaging will remain a priority. 

• PFO expects to incorporate other SFOs into the JFO 
Coordination Group. 

• Resource support continues to be provided to Connecticut. 

• There is discussion among Connecticut and New Jersey 
(Governors, PFOs, and FCOs) regarding increasing the 
HSAS level in Connecticut from Orange to Red. 

April 5. 2300-April 6, 1500 

• The investigation continues. 

• The current casualty count is 364 dead and 6,391 
hospitalized. 

• The PFO plans to implement risk communication strategy 
with State HOC. 

• The PFO continues to assist State with requests for 
resources. 

• The common operating picture continues to be refined. 


Table II- 1 provides insight into the priorities of the Connecticut PFO. These priorities included 
providing consistent and pertinent public information, monitoring the investigation, and 
facilitating the deployment of Federal support. 


UNCLASSIFIED - FOUO 

This Document Contains Canadian and United Kingdom Information 

83 








AAR 


FO R OFF I CIAL USE ONLY 


TOPOFF 3 


Communications out of the JFO sections appeared to be more sporadic, depending on the needs 
of the staff. For example, the Situation Unit in the Planning Section was in fairly regular 
communication with the State EOC and the Situation Unit at the Unified Command Post. The 
former was given casualty numbers, and the latter was contacted to promote common situational 
awareness. 

2. JFO and PFO Activities in New Jersey 

In response to the detection of multiple, suspected cases of plague in New Jersey, the Secretary 
of Homeland Security declared the situation in New Jersey to be an incident of national 
significance (at 14:(X) on April 4) and designated the New Jersey PFO (at 11:40 on April 4). 
Members of the PFO cell initially assembled at the FBI JOC and then transitioned to the Port 
Authority of New York/New Jersey Building in Jersey City, New Jersey where the JFO was 
established. During the day on April 5, the remainder of the JFO staff assembled at the Port 
Authority Building. By 16:(X) on April 5, the New Jersey JFO was fully activated. 
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Figure II-3. Organization of the New Jersey JFO^^ 


JFO Coordination Groap 



Figure 11-3 is similar to the notional diagram found in the NRP. Like Connecticut, the primary 
difference between the New Jersey organizational diagram and the NRP diagram is the presence 
of a robust PFO cell. A difference between New Jersey and Connecticut was that in the former, 
the FBI JOC was not collocated with the JFO; the JOC was located in the FBI Newark Field 
Office. The FBI provided a liaison who worked in the JFO Operations Section. 

Throughout the exercise, the primary activities of the PFO cell and JFO Coordination Group 
included collecting information and resolving issues that arose during the response. The types of 
information they collected on a regular basis included the following: 

• status of the investigation; 

• number of victims and available hospital beds; 

• New Jersey’s resource needs; 

• number of active PODs; and 

• number of citizens who had received prophylaxis. 


Figure 3 is a composite of several data sources and is intended to provide an overview of the New Jersey JFO 
structure. The Figure may not document every position or organization in the New Jersey JFO. 
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In addition to collecting information, the Joint Coordination Group and PFO cell sought to 
resolve issues as they arose during the response. The issues on which they worked included the 
following: 

• coordinating the Homeland Security Advisory System (HSAS) and State Alert System 
color codes; 

• supporting the New Jersey POD effort; 

• responding to requests from New Jersey to update the Stafford Act declaration; 

• maintaining a consistent public message; and 

• supporting State requests for resources. 

As in Connecticut, the NJ PFO was responsible for keeping the Secretary of Homeland Security 
informed about the situation in New Jersey. To do so, the PFO distributed a series of SlTREPs to 
Secretary of Homeland Security. IIMG, and HSOC during the exercise. These documents 
provide insights into the activities of the PFO cell and the issues it deemed significant. Table II-2 
summarizes a sample of the PFO SlTREPs from New Jersey and highlights the issues and topics 
that the PFO and JFO Coordination Group tracked during the exercise. 


Table 1 1-2. Summary of Selected New Jersey PFO SlTREPs 


Operational Period 


PFO Areas of Activity 

April 4, 10:30-12:30 

• 

New Jersey may be a weapon of mass destruction 
(WMD) event. 


• 

Patients are reporting flu-like symptoms. 


• 

A tank sprayer in a vehicle tested positive for Yersinia 
pestis. 


• 

VNN is reporting that many people are ill. 


• 

This situation could affect infrastructure and the 
economy. 

April 5, 23:00-April 6, 15:00 

• 

JFO has been established. 


• 

There have been 6,508 fatalities, and 3,188 people have 
been hospitalized. 


• 

Implementation of the POD plan has begun. 


• 

HSAS level has been raised to Red statewide, and PFO 
cell is working to mitigate effects. 


• 

Travel restrictions are in place. 


• 

Distribution of antibiotics to heavily impacted counties 
will occur within 24 hours. 


• 

The investigation continues (details provided). 
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Operational Period 


PFO Areas of Activity 

JFO is facilitating the flow of resources to New Jersey. 
An update to the Stafford Act declaration is pending. 
BioWatch is deploying. 

HHS is providing resources to New Jersey. 


April 6, 15:00-23:00 

• There have been 6,508 fatalities, and 3,877 people have 
been hospitalized. 

• POD operations are continuing. 

• Travel restrictions have been eased. 

• The requested declaration update has been completed. 

• PFO continues to work HSAS issues. 

• The investigation continues (details provided). 

• JFO continues to facilitate the flow of resources. 

• HHS continues to provide resources to New Jersey. 

• Rail industry remains at Alert Level 2. 

• Port security measures will have economic impact. 

April?, 08:00-15:00 

• There have been 8,070 fatalities, and 4,567 people have 
been hospitalized. 

• State POD operations continue. Federal PODs have been 
demobilized. 

• Travel restrictions have been lifted. 

• Operation Exodus has been implemented. 

• PFO cell continues to work HSAS issues with State. 

• The investigation continues (details provided). 

• State requests update to declaration. 

• JFO continues to facilitate the flow of resources. 

• BioWatch results are available (details provided). 

• U.S. Coast Guard continues to work port security issues. 

• Private sector issues are significant (e.g., tourism, worker 
absenteeism, and food safety). 

• HHS continues to support New Jersey response. 
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The JFO sections staff was located in the Port Authority Building with the PFO and JFO 
Coordination Group. The principal function of the JFO sections during the T3 FSE was to 
support the mission assignment process and facilitate the flow of resources to New Jersey. 

D. Analysts 

The analysis of JFO operations in Connecticut and New Jersey indicates that a combination of 
factors made it difficult for the JFO staff to manage its internal processes and maintain 
situational awareness. These factors included the following: 

• unclear lines of authority within the JFO; 

• undefined roles and responsibilities in the PFO cell; and 

• a lack of implemented processes for sharing information. 

Together, these factors adversely affected the operation of the JFO during the T3 FSE and 
ultimately its ability to support emergency response operations in both States. 

/. Unclear Lines of Authority within the JFO 

Observations from both New Jersey and Connecticut .suggest that the NRP and JFO SOP have 
not clearly defined the lines of authority inside the JFO. In particular, the line(s) of authority that 
connects the PFO, FCO. and JFO cell is ambiguous. Clarifying this line of authority would 
identify who in the JFO Coordination Group is re,sponsible for managing staff and directing 
activities in the JFO cell. 

At first glance, the PFO appears to be the Federal official responsible for the operation of the 
JFO, The NRP states that the PFO represents that Secretary of Homeland Security as the “lead 
Federal official.” Placing the PFO at the top of the JFO organizational diagram (see Figure ll-I) 
implies that the PFO has authority over the JFO. In addition, there was a perception among many 
at the Connecticut and New Jersey JFOs that the PFO was responsible for JFO operations. The 
NRP also states that in cases in which a Stafford Act disaster has occurred, but no PFO has been 
assigned, the FCO provides overall coordination for the Federal components of the JFO. Despite 
these statements, it is not clear whether the PFO has authority over the JFO cell. This authority is 
not assigned to the PFO or to any other official in the NRP or the JFO SOP. 

Like the PFO, there are statements in the NRP and observations from the exercise suggesting that 
the FCO has final authority over the JFO cell and the Federal resourcing process. The NRP states 
that the FCO manages and coordinates Federal resource support. During the exercise, the JFO 
cells in both States took direction from the FCO. 


For additional information on the T3 FSE resourcing process, please refer to the "Resource Requests and 
Resource Coordination” section of this report. 
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The description of the relationship between the FCO and the PFO provided in the NRP and JFO 
SOP is also vague. For example, the JFO SOP states that “the PFO and FCO (in Stafford Act 
situations in which a PFO is not designated) are responsible for the overall coordination and 
management of the JFO Coordination Group.” In addition, the NRP states that the FCO supports 
the PFO, but it does not use a term that implies a line of authority, such as “reports” or “directs.” 
The descriptions of the PFO and FCO roles and responsibilities could be interpreted at least three 
different ways. Figure 11-4 shows these three possibilities based on interpretations of what is 
written in the NRP and JFO SOP. 

Figure II’4. Possible Lines of Authority Between the FCO and PFO 



Resolving the ambiguous relatiomships between the PFO, FCO, and JFO cell will help to address 
the following important questions about the organization and operation of the JFO: 

• Who ultimately runs the JFO? 

• Who establishes priorities? 

• Who reports to whom? 

• Who can make JFO-wide decisions? 

Resolving these questions would encourage a unity of effort and improve the JFO's internal staff 
processes. 

2. Presence of a PFO Cell with Undefined Rotes and Responsibilities 

In Connecticut and New Jer,sey, substantial PFO cells operated through the end of the exercise. 
Their presence added additional coordination requirements, and their functions overlapped with 
those of the JFO. In some instances, the PFO cells worked on the same issues as the JFO cells; 
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however, the PFO cells also focused on policy issues and public messaging responsibilities that 
were not priorities for the JFO cells. The JFO cells tended to focus on resourcing and operational 
issues, rather than on policy and public information. Although the presence of the PFO cells 
increased coordination requirements inside the JFO, these costs may have been offset by the 
contributions that the PFO cell made in areas not addressed by other elements in the JFO. 

In structure and performance, the PFO cell was an additional node in the Federal response 
structure in both States. According to the JFO SOP. most of the individuals in the PFO cell are 
part of the deployed PFO support staff, a small interagency team of subject-matter experts who 
deploy with the PFO to provide initial support until a JFO is established. They are expected to 
serve as the PFO's expanded advance team and then integrate into the appropriate JFO sections 
once the JFO stood up. In practice, the PFO cells in the Connecticut and New Jersey JFOs 
remained a separate entity throughout the exercise. It is unclear exactly why that integration 
never occurred in Connecticut, though the issue was discussed on April 4. between 
approximately 22:10 and 22:30. Instead, the decision was made to maintain the cell members in 
the PFO location as technical advisors. The result of this decision was a virtual standalone 
capability for the PFO and, by default, for the JFO Coordination Group. They did not rely on the 
JFO sections for information, expertise, or situational awareness. 

In New Jersey, the PFO cell had an independent staff of more than 30 personnel per shift and 
resembled a command center, rather than an advisory group. Members of the cell manned 
positions in front of large display screens {i.e., a knowledge wall). These members represented a 
variety of organizations participating in the response, including the HSOC, FBI, U.S. Coast 
Guard, FEMA, DHS, HHS, NJ Transit, and private sector. The PFO cell operated as an 
independent staff. It held regular turnover briefs during which the outgoing shift would update 
the incoming shift about the numbers of victims, status of the investigation, issues that had been 
resolved, and tasking that the incoming staff was expected to complete. The PFO cell in New 
Jersey did not rely on the JFO sections as a primary source of information about the response. 

In New Jersey, the PFO and JFO cells worked on an overlapping set of response issues. In some 
instances, they worked on the same issues. In other cases, the PFO cell worked on issues not 
addressed by the JFO cell. Table 11-3 illustrates the issues on which the New Jersey PFO and 
JFO and JFO Cells tended to focus: 


Table 11-3. New Jersey PFO and JFO Cell Issues 


NJ Response Issues 

PFO Cell Focus 

JFO Cell Focus 

Resourcing States needs 

Yes 

Yes 

POD operations 

Yes 

Yes 

HSAS 

Yes 

No 

Updating declaration 

Yes 

No 
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Public messaging 

Yes 

No 

Reporting to DHS 

Yes 

No 

Travel restrictions 

Yes 

No 


According to Table II-3, the New Jersey PFO cell became involved in several response areas, 
such as shaping response policy (e.g., HSAS, declarations, and transportation restrictions), 
developing public messaging, and collecting/reporting information to the Secretary of Homeland 
Security. Observations made during the exercise indicate that the PFO cell assumed ownership of 
several response issues, thereby fulfilling a constructive role in the response. 

That the PFO cell worked on is.sues not addressed by the JFO cell indicates a need for reliable 
coordination inside the JFO, because such issues could have an impact on the activities of the 
JFO cell. For example, travel restrictions could affect the movement of resources and personnel, 
and changes to a declaration could affect decisions made in the JFO cell regarding the types of 
assistance that the Federal government can provide and to whom the assistance can be provided. 

Table 11-3 also highlights issues on which the JFO and PFO cells both worked. This is not a 
problem per se, but can become an issue if the staffs do not coordinate their activities, For 
example, in Connecticut, JFO staff members made the erroneous assumption that if something 
was known by personnel in the PFO cell, it was also known by their counterparts in the JFO cell. 
When the PFO and JFO cells work on overlapping issues, a reliable mechanism for intrastaff 
coordination inside the JFO mu.st be implemented. 

In Connecticut, the PFO assigned some tasks to the JFO that should have been addressed at the 
Incident Command Post level, rather than at the JFO. For example, the preparation of sampling 
and decontamination plans (see Table Il-l) for the Connecticut incident is an aspect of tactical 
operations that should have been undertaken at the Incident Command Post level. (The PFO/JFO 
may ask to review such plans, but they should be prepared by the ICP.) This illustrated the need 
for PFOs to have better training on the difference between the scope of work for JFO and ICP 
operations. 

3. Lack of Implemented Processes for Sharing Information 

In Connecticut, there were few and varied efforts to emsure common situational awareness across 
the facility; however, these efforts were largely ad hoc. There were few, if any, opportunities for 
JFO-wide briefings. Most information sharing was conducted among small groups. Although the 
New Jersey PFO cell conducted regular turnover briefs, the JFO as a whole faced information- 
sharing challenges similar to those observed in Connecticut. 

The Connecticut JFO did not hold standard shift-change briefs or situational meetings. Different 
sections in the JFO met as needed throughout the day. The battle rhythm called for an operations, 
objectives, strategy, and planning meeting each day at approximately 08:00, 09:00, 13:00, and 
post-16:00, respectively, it is unclear how often these meetings actually occurred. In fact, much 
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of the data suggest that these meetings did not occur as scheduled. In particular, data collectors 
noted that the planned daily operations briefing by the Operations and Planning Chiefs for the 
entire JFO was missing. Additionally, there were no shift-change briefs/meetings for the JFO as 
a whole. Rather, turnover was largely left up to individuals in the PFO cell, in the different 
sections, and in the ESFs. 

The Situation Unit of the Planning Section, the group responsible for the common operating 
picture in the JFO, was at a distinct disadvantage for much of the exercise because it was not 
present in the PFO workspace and conference room and the flow of information out of that room 
was poor.^^ For example, the Connecticut PFO cell and JFO Coordination Group were getting 
fairly regular updates from the JOC about the investigation, but the Situation Unit could only get 
that information from the State EOC or RRCC. 

The Connecticut PFO cell and JFO Coordination Group had no formal method by which to pass 
information to persons outside of the room. The only individuals who went back and forth 
between the PFO space and the JFO were the FCO and SCO. Although they relayed some 
information, they had neither the time nor the processes in place to be the primary conduits. 
Some agencies had representatives in the PFO room, either in the PFO cell or as SFOs in the JFO 
Coordination Group. To a certain extent, these agencies were at an advantage because they may 
have received regular updates from those repre-sentatives. But this may have also added to 
coordination challenges, as those individuals and ESFs knew more than the other staffers in the 
JFO sections. For example, the HHS SFO involved ESF-8 in much of the dialogue and debate 
about transferring patients out of the State. But when ESF-8 members tried to coordinate with the 
Operations Branch, confusion reigned because the latter were not up to dale on the situation. 

The only concerted effort to share information in the Connecticut JFO appeared to be the 
consolidation of the twice-daily SITREPs for the IIMG, but this was largely a paper drill for 
DHS headquarters, with different sections and Federal, State, and local agency representatives 
submitting their input to the Situation Unit, who then passed it to the HSOC watch slander in the 
PFO cell. Additionally, the SITREP was a one-way information flow for the most part, with 
contributors pushing information up, but not making an effort to move information horizontally 
around the JFO or back down from the PFO. Further, it is apparent from reviewing those 
SITREPs that little effort was made to confirm inputs or correct errors. Within SITREPs, we find 
examples of contradictory information. For example, much confusion existed in the JFO 
Coordination Group at the conclusion of the exercise as to the mechanism used by the terrorists 
to disperse the mustard agent. The group still believed that the agent came from the truck bomb 
rather than the aircraft. This is troublesome, considering the FBI had concluded that the aircraft 
was the device and that the SAC was a member of the JFO Coordination Group. It is evident that 


The physical layout of the Connecticut JFO included one large room for the JFO sections, a second large room for 
the JOC. and a small room off to the side for the PFO sell and JFO Coordination Staff. JFO Coordination Group 
meetings and conference calls were also held in the smaller room. The two workspaces were divided by a set of 
doors. Access to the JOC was slricily limited to law enforcement personnel and persons with appropriate badges. 
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consolidation and clarification of information did not occur. In the same SITREP from 03:00 on 
April 5, it was reported that: 

• the airplane [in Maine] tested positive for precureors to mustard; and 

• the airplane [in Maine] was only equipped with normal crop dusting equipment, and all 
further forensic examinations yielded negative results. 

The SITREP from 15:00 on the same day did not clarify the contradictory infonnation. In fact, it 
reported that: 

• per the Transportation Security Administration (TSA), the FBI analysis of the 55-gallon 
tank aboard the plane yielded no trace of mustard, but rather contained residue of 
ammonium nitrates; and 

• per the FBI, the two drums found on the plane tested positive for sulfur mustard, and 
additional samples analyzed by Edgewood also te.sted positive. 

It is not suiprising that the Connecticut JFO Coordination Group was never clear on the dispersal 
mechanism. In fact (as is discussed in a later thread), confusion persisted throughout the exercise 
and across the operations centers. Improved coordination and communication within the JFO. to 
include the JOC. may have resolved some of the misperceptions. 

4. Issues from Previous Exercises 

As the T3 FSE had, the T2 FSE exercised the PFO position but not the JFO structure, because 
the JFO is a recent addition to the Federal response effort. The comparison of these two exercises 
indicates that there has been little improvement in this area since T2. In at least one area, the 
issue may have worsened. Table II-4 compares the T3 FSE experience with the PFO with the 
experience of other exercises and notes if any changes were observed. 

Table 11-4. Comparison of T3 FSE with Previous Exercises 


j T2 FSE 

SOEs 

T3 FSE J 

SIGNIFICANT DECISIONS 

• Secretary of Homeland Security 

1 designated PFOs and deployed them to 
Washington and Illinois. 

• It was the first time the PFO concept 
was implemented. 

• The JFO would be established ' 
after an incident of national 
significance (INS) was declared. | 

1 

• Secretary of Homeland Security 
appointed PFOs In New Jersey and 
Connecticut. 

• Once an INS was declared in both 
venues, JFOs stood up in New 

Jersey and Connecticut. 

ISSUES/OBSERVATIONS 

• FSE demonstrated that the new PFO 
role would need a dedicated staff to be 
effective. 

1 

• In Connecticut, the PFO cell 
duplicated much of the capabilities 
and expertise resident In the JFO 
sections, but it lacked its own clear 
Dunxrse or delineated 
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responsibilities. 

• Overlapping or competing activities 
occurred in the PFO cell and the 

JFO section. 

• Roles and responsibilities of the PFO 
were not well defined relative to the 

FEMA Regional Directors and FCO. 


• Lines of authority and coordination 
among the PFO, FCO, and JFO 
sections were unclear and 
hampered unity of effort. 

• The relationship between the PFO 
and FCO is not formalized, and final 
authority over the JFO cell was 
unclear. 



• The JFOs did not follow standard 
processes for sharing information 
internally. 


• Participants acknowledged that 
there would be confusion in the 
Immediaie aftermath of an INS 
prior to the establishment of a 
JFO. 

• Once the NRP Is activated, the 
JFO must rapidly assume its 
role as the central point of 
coordination for Federal, State, 
and local officials and for the 
effective use of Federal 
lncident>related response and 
recovery resources. 



The comparison of the T2 and T3 experiences suggests that there has been little improvement in 
the process of PFO operations. Although the addition of the PFO cell addresses an issue 
identified in the T2 FSE After-Action Report, its presence in the T3 FSE adversely affected the 
PFO's ability to unify the Federal response effort. The need for belter defined roles and 
responsibilities of the Federal officials supporting the respon.se remains. 

E. Conclusions 

The detection of plague in New Jersey and the release of a mustard agent in Connecticut 
prompted Federal officials to activate JFOs and select PFOs for both States. The analysis of JFO 
operations indicates that the JFO staff encountered problems coordinating the activities of JFO 
staff elements. For example, lines of authority were unclear, and the prominent role played by 
the PFO cells in both States complicated JFO operations. Furthermore, the JFO staff did not 
follow standard processes for sharing information internally. Resolving these structural and 
process issues would improve staff operations and ultimately strengthen the JFO’s ability to 
coordinate Federal and State response efforts. 

The analysis of the NRP, JFO SOP, and exercise observations indicates that lines of authority 
and coordination in the JFO are unclear. The relationship between the PFO and FCO is not 
formalized, and final authority over the JFO cell is ambiguous. Clearly documenting these 
relationships would eliminate a potential source of confusion in JFO operations. 


UNCLASSIFIED - FOUO 

This Document Contains Canadian and United Kingdom Information 

94 



AAR 


FO R OFF I CIAL USE ONLY 


TOPOFF 3 


The presence of vigorous PFO cells in New Jersey and Connecticut complicated operations in 
the JFOs. Their presence added additional internal coordination requirements. In some instances, 
the PFO and JFO cells on an overlapping set of response issues or worked on the same issues. In 
other instances, the PFO cell worked on issues not addres.sed by the JFO cell, but the outcomes 
of these issues could have an impact on activities in the JFO cell. The observations that the PFO 
operated as a separate node inside the JFO and worked on some of the same issues as the JFO 
cell indicate a need for a reliable mechanism for intra-staff coordination in the JFO. 

Although the PFO cell played a prominent role in the T3 FSE, the NRP and JFO SOP do not 
provide detailed descriptions of its roles and responsibilities. JFO operations would also benefit 
from additional information about how the PFO cell is expected to support JFO operations. 

Observations from Connecticut indicate that information sharing and dissemination inside the 
JFO were problematic. There were few, if any. opportunities for JFO-wide briefings, and there 
was no formal mechanism for establishing a common operational picture. Instead, the sharing of 
information inside the JFO was largely informal and ad hoc. Formal information-sharing 
procedures would likely improve the situational awareness of JFO members. Additionally, it may 
be beneficial to identify an individual whose sole responsibility is the management of the facility 
and the shared JFO battle rhythm. This person should have no operational responsibilities in the 
response, but would manage the integration of the JFO itself. 

/. Recommended Courses of Action 

• Clarify the relationship between the PFO, PFO cell, and FCO, to include the scope of 
their operational responsibilities and their authorities within the JFO. 

• Develop a checklist to manage the integration of the PFO cell with the JFO sections 
once the latter is fully activated. 

• Implement formal information-sharing processes and procedures within the JFO to 
improve internal situational awareness. Identify, train, and authorize an individual to 
manage the JFO and the information-sharing processes. 

III. Resource Requests and Resource Coordination 

A. Introduction 

The TOPOFF 3 Full-Scale Exercise (T3 FSE) provided the Federal government an opportunity 
to exercise the process of supporting States that have been overwhelmed by a significant terrorist 
attack involving a weapon of mass destruction (WMD). Following the releases of Yersinia pestis 
and sulfur mustard agent, officials in New Jersey and Connecticut requested a variety of 
resources from the Federal government, including medical supplies, healthcare professionals, 
transportation support, security personnel, mortuary affairs teams, and decontamination units. In 
addition to these State requests. Federal agencies pushed assets to support the State responses. 

Exercise observations indicate that the resourcing process was problematic in both States. State 
and Federal officials were uncertain about what had been requested, who requested it, and what 
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was being provided. The questions were prompted by a combination of factors that included the 
following: 

• participants used three different resourcing processes that were not well coordinated; 

• Federal and State officials struggled with the implementation of these processes; and 

• reliable information about resources was not readily available. 

Delays and uncertainty caused by these issues frustrated participants, who were often uncertain 
about who had requested what. Resolving these issues would strengthen the ability of Slate and 
Federal officials to match the resource needs of responders 
with available assets. 

B. Background 

The Federal government can provide support when States are 
overwhelmed by a major incident. To access these resources, a 
State must first identify what is needed to support the 
response. In this step. State officials compare the response 
needs with the resources that are available from State and local 
agencies. If unmet needs remain, the Stale can request 
additional resources (i.e., both personnel and materiel) from 
the Federal government. 

During emergency operations, local responders are usually the 
first to arrive on-scene. At that lime, the Incident Commander 
(IC) assesses the response needs and submits resource reque.sts 
to the local emergency operations center. Requests that exceed 
local capabilities are submitted through the State’s emergency 
response chain of command to the State Emergency 
Operations Center (EOC). The EOC will attempt to match the 
needs of the 1C with assets that may exist elsewhere in the 
State or be accessible through mutual aid agreements with 
neighboring States such as the Emergency Management Assistance Compact which was 
exercised by New Jersey during the FSE. In emergencies that do not have a defined incident site, 
such as a Statewide disease outbreak, local EOCs and agencies can submit their resource 
requirements to the State EOC, which will attempt to locate the needed resource somewhere in 
the State. If it cannot locate the required support, the State can submit its request to the Federal 
government. 


Si!M.\iARY Of Conclusions: 
Rf-source Request and 
Coordination Process 

• The use of multiple resource 
processes created uncertainty 
and adversely affected 
situational awareness. 

• State and Federal officials 
struggled with the 
implementation of the Federal 
resourcing process. 

• The role of the HHS SERT was 
neither well-defined nor 
understood by participants. At 
times the SERT duplicated 
functions performed by ESF #8 
in the JFO. 

• Information about the status of 
resources was not readily 
available and the process lacked 
transparency. 


The State may be able to access additional resources through agreements with neighboring jurisdictions such as 
the Emergency Management Assistance Compact which wa.s exercised by New Jersey during the FSE. 
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State officials can use two methods to obtain support from the Federal government: (1) support 
provided under the Stafford Act mission assignment process, coordinated through the JFO, and 
(2) direct agency support. 

7. JFO Mission Assignment Process 

During a major incident. States can access Federal resources by engaging the JFO and requesting 
resources through the mission assignment process. This process requires that States document 
their requests on action request forms (ARFs), on which State officials describe the assistance 
they are requesting. Before the JFO can draft a mission assignment, the State Coordinating 
Officer (SCO), Federal Coordinating Officer (FCO), and the JFO Operations Section Chief 
review the ARF. If approved, the JFO drafts a mission assignment (a work order) directing a 
Federal agency to complete a task.^' For example, a mission assignment could be used to task 
the Centers for Disease Control and Prevention (CDC) to provide epidemiologists to a State 
experiencing a disease outbreak. 

Once drafted, the mission assignment is assigned to one of 15 emergency support functions 
(ESFs). ESFs are members of the JFO staff and SMEs on a functional area. Table lll-l lists the 
ESFs described in the NRP and identifies the coordinator for each. 


Table III-I. Emergency Support Functions (ESFs) 


ESF No. 

ESF Name 

Coordinating Department/Agency 

ESF#1 

Transportation 

Dept. ofTransportation 

ESF #2 

Communications 

Dept, of Homeland Security 

ESF #3 

Public Works and Engineering 

Dept, of Defense 

ESF #4 

Firefighting 

Dept, of Agriculture 

ESF #5 

Emergency Management 

Dept, of Homeland Security 

ESF #6 

Mass Care, Housing, and Human Services 

Dept, of Homeland Security 

ESF #7 

Resource Support 

General Services Administration 

ESF #8 

Public Health and Medical Services 

Dept, of Health and Human Services 

ESF #9 

Urban Search and Rescue 

Dept, of Homeland Security 

ESF #10 

Oil and Hazardous Materials Response 

Environmental Protection Agency 

ESF#I 1 

Agriculture and Natural Resources 

Dept, of Agriculture | 


See Unit 4 al http://training.fema.gov/EMrWeb/IS/is292Isl.asp. 
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ESF No. 

ESF Name 

Coordinating Department/Agency 

ESF #12 

Energy 

Dept, of Energy 

ESF #13 

Public Safety and Security 

Depts. of Homeland Security and Justice 

ESF #14 

Long-term Community Recover and Mitigation 

Dept, of Homeland Security 

ESF#15 

External Affairs 

Dept, of Homeland Security 


A principal function of the ESF groups is to support the mission assignment process, which 
provides Federal resources to the State.^^ The ESF group responsible for a particular mission 
assignment will contact the Federal agency and task it to provide the support outlined in the 
mission assignment. The ESF staff will then coordinate the delivery of the requested support to 
the State. The tasked Federal agencies can be reimbursed for the costs of providing this support 
under the Stafford Act if an emergency or major disaster is declared. 

2. Direct Federal Af>ency Support 

Some Federal agencies have their own authorities to provide direct support to States. In some 
instances, the support is provided at the request of the State. In other instances, the Federal 
agency support is unsolicited, direct support to the State. For example, the Department of Health 
and Human Services (HHS) may provide epidemiologists and a Secretary's Emergency 
Response Team (SERT) to a State experiencing a disease outbreak. 

The SERT is a deployable team of public health SMEs that “directs and coordinates the activities 
of all HHS personnel deployed to the emergency site to assist local. State, and other Federal and 
government agencies as applicable response effort for HHS.”^^ The SERT will likely deploy 
when the HHS Secretary declares a public health emergency. According to the HHS CONORS, 
the SERT receives mission assignments, priorities, and objectives from the HHS leadership. 
These mission assignments will be coordinated with, and may be at the request of, other Federal 
entities, particularly DHS. Once in the field, the SERT: 

• directs and coordinates HHS response assets; 

• represents HHS in interactions with local. State, territorial, and tribal government public 
health and medical incident management authorities, as well as the regional response 
structure; 

• assesses the requirements or potential needs for additional HHS assistance; 


ESFs also coordinate assistance among Federal agencies. 

” U.S. Department of Health and Human Services. Concept of Operations Plan (CONOPS) for Public Health and 
MedicaJ Emergencies. March, 2004. 
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• facilitates the transmission of incident information from incident authorities to the 
Assistant Secretary for Public Health and Emergency Preparedness (ASPHEP) through 
the Secretary’s Command Center; and 

• provides continuous assessment of the adequacy of the HHS response to the HHS 
Secretary through the ASPHEP.^ 

Direct agency support does not use the mission assignment process or require JFO approval. 
Direct support expenditures are not reimbursed under the Stafford Act. The Federal agency 
requesting the support usually funds the support. 

For additional information about the Stafford Act and the NRP discussion about Federal-to- 
Federal support, refer to the “Integrating Re.sponses to Incidents of National Significance” 
section of this report. 

C. Reconstruction 

The nature of the disa.sters in Connecticut and New Jersey caused the States to organize their 
responses differently. These differences affected how the officials in the two States implemented 
their resource request processes. In Connecticut, there was a definitive incident site containing 
victims and debris. From a nearby command post, the IC — later the Unified Command — could 
assess the needs of the tactical units and pass requests for support to State and Federal agencies. 
In New Jersey, there was no single incident site and no .single, designated IC. Yersinia pestis was 
disseminated over areas of Middlesex and Union Counties, and victims were located throughout 
the State. Unlike in Connecticut, there was no IC to develop resource needs at the tactical level 
in New Jersey. Agencies, such as county health departments, and organizations, such as 
hospitals, participating in the New Jersey response coordinated requests for assistance through 
their local EOC, State EOC, and State Health Command Center (HCC). 

I. Connecticut Response Structure and Resource Needs 

The sulfur mustard gas attacks in New London resulted in a demand for resources that exceeded 
the capabilities of the first responders. During the first hours of the crisis, the 1C in Connecticut 
mobilized resources through established agreements for mutual aid or through the New London 
and State EOCs. Late in the day on April 4, the Unified Command Post (UCP) replaced the 
Incident Command Post (ICP). The UCP staff included the first responders from the ICP with 
augmentation from many State and local Federal agencies, including the US Coast Guard, FBI, 
DHS, EPA. Connecticut Department of Environmental Protection (DEP), National Disaster 
Medical System, (NDMS) and Connecticut Department of Public Health (DPH). The UCP 
participated in the resource request and allocation process through the end of the exercise. 


U.S. Department of Health and Human Services. Concept of Operations Plan (CONOPS) for Public Health and 
Medical Emergencies. March, 2004. 
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The State EOC submitted resource requests to the JFO when the State and local agencies could 
not meet the needs. To minimize disruption as the JFO stood-up, the JFO relied on FEMA’s 
Regional Response Coordination Center (RRCC) located in Maynard, Massachusetts, to 
coordinate the mission assignment process during the early hours of the exercise. 

Table III-2 lists examples of resources employed in Connecticut during the exercise. These 
resources are grouped into two broad categories, medical and nonmedical. 
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Table 111-2. Examples of Resources Employed or Requested During the Connecticut Response 


Resources Needs 

Medical-related support 


Connecticut 


Hospital capacity Area hospitals 


Hospital census 


Federal/Other 


Nationwide 

10,000 Bed alternate care facility (ACF) 


Rapid Response Registry 


Medical personnel DMAT/Medica! Reserve Cotps Disaster Medical Assistance Team (DMAT) 


Medical supplies 


Mortuary support Refrigerated trucks 


Patient movement EMS/National Guard 


Nonmcdical support 


Animal removal Local resources 


Decontamination State resources 


Dive teams Local resources 


Family assistance/feeding 


Ground transportation Local resources 


Response support State and local resources 


Incident support National Guard (CST) 


Security State Police, CTNG (QRF) 


Ventilators^ronchial dilators (SNS) 


Disaster Mortuary Operations Resptinse Team 
(DMORT) 


National Disaster Medical System (NDMS) 



Urban search/rescue 


Connecticut Urban Search and 
Rescue (USAR) 


Red Cross 


JFO and PFO Cells 

Defense Coordinating Officer (DCO) 


Domestic Emergency Support Team (DEST) 
Emergency Response Team-A and ERT-N 


Department of Defense Quick Reaction Force 
(QRF) 


MA & NJ USAR 


Many resource requirements were met entirely with local or State assets, including: 

• transportation assets to remove dead animals; 

• dive teams to search for secondary devices; 

• decontamination assistance for two area hospitals; and 

• vehicles to support emergency response personnel at the incident site. 
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In other cases. State resources were augmented with Federal assets or those from neighboring 
States. For example: 

• New Jersey and Massachu-setts provided USAR teams to assist with rescue efforts. 

• The Department of Defense provided a Quick Reaction Force (QRF) to relieve 
Connecticut National Guard units protecting a local nuclear power plant. 

• The American Red Cross (ARC) established a Family Assistance Center (FAC) and 
provided food at the incident site. 

• The FBI requested the deployment of the Domestic Emergency Support Team (DEST), 
an interagency team of subject matter experts who respond to incidents involving WMD. 

• FEMA’s RRCC deployed an Emergency Response Team — Advanced Element (ERT-A). 

The Federal government also supported Connecticut’s efforts to care for the victims of the 
attack. This support included the deployment of Disaster Medical Assistance Teams (DMATs), 
Disaster Mortuary Operational Response Teams (DMORTs), and medical supplies from the 
Strategic National Stockpile (SNS). 

2. Resources Needed During the New Jersey Response 

The release of Yersinia pestis in New Jersey created a demand for resources that exceeded the 
capabilities of State and local governments. The response activities that placed the greatest 
demands on the State’s resources were Points of Dispensing (POD) operations, treating victims, 
and mortuary affairs. For example, staffing the State’s PODs required thousands of workers. 
Additional resource demands were placed on the State’s healthcare facilities — by April 8, 
approximately 37,500 residents (sick and dead) had developed plague and many of those had 
sought treatment. Similar demands were placed on New Jersey’s mortuary infrastructure. State 
officials had to locate facilities to store and dispose of more than 9,500 bodies, prompting a 
request for Federal assistance. Table 1II-3 lists examples of these resource needs and identifies 
the organizations from which resources were requested or provided. 
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Table 111-3. Examples of Resources Employed or Requested in the New Jersey Response 


Resources/Assistance 

Medical-related support 


New Jersey 


Hospital capacity Area hospitals 


Agent identification Hospital labs 
State labs 


POD staffing Local health departments 

New Jersey National Guard 


Medical personnel Hospital staffs 
Local resources 


Medical supplies Local supplies 


Mortuary support Funeral directors 

County medical examiners 


Patient movement Local ambulances 


Nunmedical support 


Veterinary support Local support 


Transportation Local resources 


Response support State and local resources 


Federal/Other 


10.000 Bed alternate care facility (ACF) 


CDC labs 

Epidemiologists (CDC) 


Veterans Affairs staff 
Federal Protective Services staff 
Postal Service employees 


DMAT 

NDMS management support team (MST) 

Emergency Management Assistance Compact 
(EMAC) 

Veterans Affairs health professionals 


Antibiotics (SNS) 

Technical advisory response unit (TARU) 
Ventilators 


DMORT 

Refrigerated trucks 


NDMS personnel (Operation Exodus) 

2S0 ambulances 

NY Air National Guard C-130 (Operation Exodus) 


Veterinary medical assistance team (VMAT) 


Helicopters 


FEMA ERT-A deployed to State EOC 

HHS SERT 

JFO and PFO Cells 


Law enforcement New Jersey State Police 
Local law enforcement 
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Public messaging State public info officers 

County public info officers 


Joint Information Center 
Leaflet drop 

50 public information officers 


Although Table 111-3 is not exhaustive, it lists the types of resources that were provided by 
Federal, State, and local agencies during the exercise. To access many of the Federal resources 
listed in Table III-3. officials in New Jersey exercised the mission assignment process through 
the JFO. Support for health and some medical support could also be requested through the HHS 
SERT. 

In many instances, the Federal support was notional. Equipment and personnel were identified 
on paper, but not actually deployed (e.g., refrigerated trucks, the alternate care facility, and many 
medical personnel); however, some support was real, for example: 

• The CDC deployed SNS training pallets to the New Jersey receipt, stage, and storage 
(RSS) site. 

• The TARU team deployed to New Jersey and met the SNS shipments. 

• The ERT-A deployed to the State EOC in West Trenton. 

• The New York National Guard flew a C-130 to New Jersey and loaded the aircraft with 
Operation Exodus patients. 

The resources that were actually deployed during the T3 FSE were preplanned as part of the 
exercise, 

D. Analysis 

The analysis of the State and Federal resourcing efforts indicates that a combination of factors 
impeded the ability of the two States to access Federal support during the T3 FSE. These factors 
included: 

• Participants used three different resourcing processes that were not well coordinated. 

• Federal and State officials struggled with the implementation of these processes. 

• Reliable information about resources (e.g., the status of requests) was not readily 
available. 

Together, these factors contributed to a breakdown in the resourcing process, making it difficult 
for participants to match the State’s needs with available Federal resources. In New Jersey and 
Connecticut, participants were uncertain about what had been requested, who had requested it, 
and what the status of the request was. Without access to this information, response planners and 
decision makers could not fully comprehend the complete resource picture. 
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I. Impact of Resourcing Issues 

The comparison of resource awareness presented in Table II1-4 indicates that the T3 FSE 
resourcing process did not meet the needs of the response organizations. The data in Table III-4 
demonstrate that responding organizations in New Jersey were often unaware of the activities of 
their counterparts. This lack of awareness and the inconsistent information provided by and 
available to these organizations suggests that the process of matching the resource needs of New 
Jersey with available Federal assets did not function as intended. 

The entries in Table lU-4 are compiled from T3 FSE authoritative sources. The State EOC 
entries are based upon copies of ARFs provided by the New Jersey Office of Emergency 
Management (OEM). The entries under the IIMG heading are based on the IIMG list of “Federal 
Assets Deployed.” The entries under the HHS support heading are based on HHS SITREPs. The 
JFO/RRCC entries are based on two mission assignment logs compiled and provided by FEMA. 
These entries indicate that officials supporting the New Jersey response did not have a consistent 
picture of the resources that had been requested and deployed. 


Table III-4. iMck of Resource Awareness in New Jersey 


Resource 

State EOC 

IIMG 



Bio Emer. Support Team (BEST) 

No request 

Deployed 

Not listed 

No MA* 1 

800 units of blood 

No request 

Deployed 

Not listed 

NoMA I 

Relocatable field labtiratory 

No request 

Deployed 

Not listed 

NoMA 

Disaster portable morgue unit 

2 requested 

1 deployed 

Not listed 

1 assigned 

DMORT 

8 requested 

2 deployed 

Deploy all 
available 

2 assigned 

2viaNDMS 

DMAT 

No request 

2 deployed 

14 staged 

5 deployed 

No action -10 
DMATs staged 

VMAT 

2 requested 

2 deployed 

Not listed 

I viaNDMS 

Management support team 

No request 

3 deployed 

Deployed 

No MA 

Strategic national stockpile support 

Requested by 
governor 

Deployed 

Deployed 

NoMA 

Ventilators 

2500+ requested 

2000 deployed 

Not listed 

MA issued 

1200 US Public Health officers 

No request 

Deployed 

Not listed 

No MA 

3(X)0 personnel from MRC 

No request 

Deployed 

Not listed 

MA issued 

Epidemiological teams 

No request 

Deployed 

40 deployed 

No MA 

HHS ARC mental health team 

No request 

Deployed 

Not listed 

NoMA [ 
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Resource 

State EOC 

IIMG 

1 

HHS Support 

JFO/RRCC 

10,000 bed alternate care facility 

No request 

Not listed 

HHS direct 
request 

No MA 

Alternate care facility staff 

Requested 

Not listed 

HHS direct 
request 

MA issued 

Refrigerated trucks/trailers 

100 requested 

Not listed 


MA issued 

400 emergency medical techs 

No request 

Not listed 


No MA 

2 X 250 bed DoD field hospital 

No request 

Not listed 

Requested 

NoMA 

SNS TARU 

No request 

Not listed 

Deployed 

No MA 

Epidemiologist to NJDHSS 

Requested** 

Not listed 

Deployed 

No MA 

15,000 POD workers 

No request 

Not listed 

Working 

NoMA 

4,000 POD security personnel-FPS 

Requested 

Not listed 

Not listed 

MA issued 

DMART 

No request 

Not listed 

Not listed 

Requested 

2,000 crisis counselors 

Requested 

Not listed 

Not listed 

Rejected 

100 body handlers 

Requested 

Not listed 

Not listed 

Unresolved 

250 ambulances 

Requested 

Not listed 

Not listed 

Unresolved 

500 POD personnel 

No request 

Not li.sted 

Not listed 

Unresolved 

12,000 medical personnel 

No request 

Not listed 

Not listed 

MA issued 

Mobile communications for NJ ME 

No request 

Not listed 

Not listed 

MA issued 

261 medical personnel 

Requested 

Not listed 

Not listed 

Unresolved 

50 public information officers 

Requested 

Not listed 

Not listed 

Unresolved 

Staff for 500 bed facility 

Requested 

Not listed 

Not listed 

Unresolved 

100,000 N95 respirators 

Requested 

Not listed 

Not listed 

MA issued 

100 PPE for DMORT 

Requested 

Not listed 

Not listed 

NoMA 

4 helicopters 

Requested 

Not listed 

Not listed 

No MA 

POD security 1826 personnel 

Requested 

Not listed 

Not listed 

No MA 

POD security 2350 personnel 

Requested 

Not listed 

Not listed 

NoMA 

50 body trackers 

Requested 

Not listed 

Not listed 

NoMA 

Generators and mobile lights 


Not listed 


No MA 

Leaflet drop 


Not listed 


No MA 


* MA = mission assignment; ** Based upon a request from the NJ Department of Health and Senior Services 
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The list of requested and provided resources in Table III-4 highlights the impact that the three 
resource issues noted above (i.e., the use of multiple processes, implementation struggles, and a 
lack of ready information) had on the T3 FSE resourcing process. In short, this process was 
fragmented. Most organizations involved in the resourcing process had little insight into what 
other organizations were doing to provide New Jersey with the resources it needed to respond to 
the release of Yersinia pestis. 

The lack of consistent information about resources and uncertainty among those supporting the 
resourcing process is problematic because: 

• Decisions made under such conditions often do not account for key information or 
address relevant issues. 

• Effective planning is dependent on maintaining situational awareness. 

• Staff members have to take time to resolve the uncertainties and establish situational 
awareness. 

The time they take to do so will reduce the time they can devote to other response activities, 
thereby delaying the deployment of needed resources. 

2. Multiple Resource Processes Existed Not Coordinated 

The T3 FSE resource request and coordination process was actually three separate processes: 

• the Stafford Act mission assignment process through the JFO; 

• State requests for direct support made through the SERT (New Jersey) and the Unified 
Command Post (Connecticut); and 

• direct support provided by the Federal government without requests from the State. 

The process of requesting and coordinating resources broke down (e.g., many State ARFs were 
not resolved and organizations lost situational awareness) when these three processes became 
intertwined. In many instances, participants were not clear about which process they were 
supporting. The employment of all three processes in the T3 FSE hampered resource 
coordination. In both New Jersey and Connecticut, many resource requests were not addressed 
and State officials were not aware of assets sent to the States by the Federal government. 

a. Resourcing Process #l : Mission Assignment Process 

Figure III-l depicts the New Jersey Stafford Act mission assignment process in which the State's 
requests for support were submitted to the JFO through the FCO, SCO. and JFO Operations 
Chief. 
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Figure ///-/. JFO Mission Assignment Process in New Jersey^'^ 



The mission assignment process depicted in Figure lll-l was the primary mechanism used by 
New Jersey to request support from the Federal government. With the support of the ERT-A, 
which deployed to the State EOC, New Jersey officials submitted 43 ARFs through the mission 
assignment process. New Jersey’s requests for support originated from the NJDHSS, New Jersey 
Department of Agriculture, or State EOC. Requests were submitted through the State EOC to the 
JFO. The State EOC submitted eight ARFs on behalf the NJDHSS and one on behalf of the NJ 
Department of Agriculture. The remaining 34 ARFs originated in the State EOC. 


A similar process existed in Connecticut. 
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b. Resourcing Process #2: SERT Process 

The presence of the SERT affected the resourcing process in two ways. First, the SERT 
introduced another resource process, direct agency support. Second, its role in the overall 
resource process was unclear. 

In the exercise, participants merged (albeit unintentionally) the direct support and mission 
assignment processes into a single resource request structure. Figure II1-2 depicts the 
combination of the two processes with the new connections between the HHS, State Health 
Command Center, and the JFO. 

Figure III-2. SERT Support for the Resource Request Process in New Jersey 



The process depicted in Figure I1I-2 differs from the model mission assignment process depicted 
in Figure IIl-l. In the first structure, ARFs are typically assembled by a single State organization, 
such as the State EOC, passed to the Federal and State Coordinating Officers in the PFO Cell, 
and then forwarded to the JFO for mission assignments. The T3 FSE experience in New Jersey 
was different because two different State organizations — the EOC and HCC — submitted 
resource requests to two different Federal organizations (i.e., the JFO and SERT). 
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As depicted in Figure III-2, the SERT accepted resource requests from the State under the 
authority of the public health emergency declaration.^ The SERT deployed to New Jersey to 
help State officials integrate available Federal medical resources into the State's response efforts. 
In this capacity, the SERT participated in both the mission assignment and direct support 
resource request processes. Examples of SERT support for the mission assignment process 
included helping to arrange the following assets for New Jersey: 

• 250 ambulances; 

• security for PODs through ESF #13; 

• 100 refrigerated trucks; and 

• NDMS counseling at the PODs. 

The SERT also responded to direct requests from the NJ Department of Health and Senior 
Services to locate 12,000 medical professionals to support the State’s acute care facilities. 
Supporting both processes simultaneously complicated tracking efforts and tended to blur the 
SERT's role in the response, rather than facilitate the flow of Federal support. 

Participation by the SERT further complicated the New Jersey resource request process because 
the role of the SERT was not well-defined or understood by the participants. State officials had 
difficulty distinguishing the roles of the SERT and JFO. At times, the reaction of State officials 
was to work with both organizations, thereby increasing the likelihood that their request would 
be fulfilled. This method, however, made it difficult to coordinate the overall resource process. 

Uncertainty over the role of the SERT was not limited to New Jersey officials. Near ENDEX, the 
SERT Operations Chief consulted with ESF #8 staff members in the JFO to resolve outstanding 
resource requests. The ESF #8 staff asked why the SERT was passing ARFs to ESF #8 to give to 
the JFO Operations Chief when it appeared to them that the support would be funded directly by 
HHS. It is not clear whether this exchange was the result of a misunderstanding between officials 
or a lack of familiarity with the process, but it suggests that the SERT’s role in the Federal 
resource process had not been resolved during the exercise. 

One potential concern is that the SERT duplicates the function of the JFO’s ESF #8, which is 
responsible for supporting the mission assignment process. According to the NRP, ESF #8 
“provides a mechanism for coordinated Federal assistance to supplement State ... resources in 
response to public health and medical care needs.” HHS defines a similar role for the SERT. The 
function of the SERT is “to provide assistance to State and local jurisdictions responding to 
public health emergencies.”'^’ The primary difference between ESF #8 and the SERT is that ESF 
#8 can task other Federal agencies to support the State’s medical response. During the exercise. 


For more information about the T3 FSE declarations please refer to the "Integrating Responses to Incidents of 
National Significance" section of this report. 

www.hhs.gov/ophep/pre.sentation/hauer3.himl 
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SERT members helped to staff the ESF #8 in the JFO, further confusing their role in the resource 
request and coordination process. 

c. Resourcing Process #3: Unsolicited Support (i.e., “Asset Push”) 

Unsolicited support from the Federal government was the third resource process observed in the 
T3 FSE that further complicated the resourcing efforts of officials in New Jersey and 
Connecticut. Figure III-3 depicts the deployment of these resources and completes the resource 
request and coordination process diagram for New Jersey. 
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Figure 111-3. Complete Resource Request and Coordination Process for New Jersey 



During the exercise, the Federal government “pushed" unsolicited resources to New Jersey, 
including: 

• a 10,000 bed alternate care facility (ACF); 

• two 250-bed DoD field hospitals; 

• several Disaster Medical Assistance Teams; 

• 30,000 remains pouches; 

• Biological Emergency Support Team; 

• 400 emergency medical technicians; 

• 800 units of blood: 

• 300 military police; 

• field laboratory; and 

• 20 chaplains. 

The most notable of these resources was the 10,000-bed ACF. The States’ experience with the 
ACF highlights the types of resourcing issues that can arise when unsolicited assets are 
unknowingly pushed to the States. HHS attempted to deploy the ACF to New Jersey without 
consulting State officials. When these officials learned about the deployment, they requested that 
the delivery be canceled. The next day, the New Jersey State Medical Director reversed the 
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earlier decision and requested that the SERT arrange the redeployment of the ACF. HHS also 
pushed an ACF to Connecticut and expected the logistics to be managed by the DPH ECC; 
however. Connecticut was not aware of the arriving ACF or the need to manage the logistics. 
HHS also determined that the facility would be staffed with several out-of-state DMATs. even as 
the Stale was trying to distribute these DMATs to various area hospitals. Neither ACF 
deployment was coordinated with State authorities. The deployment of unsolicited assets can be 
helpful, but their arrival can also surprise State officials, who must replan on short notice to 
incorporate the asset into the response. 

3. Resourcing in Connecticut 

To this point, the resourcing analysis has focused on events in New Jersey; however, resourcing 
issues also existed in Connecticut. The resourcing structure in Connecticut was similar to the 
structure observed in New Jersey; in both States, there were three primary resource paths. The 
foremost difference between the two States was that in Connecticut, the Unified Command Post, 
rather than the SERT, provided another resource path in addition to the mission assignment and 
unsolicited support paths. Nevertheless, the result was the same: participants were uncertain 
about who had requested what. 

In Connecticut, observations indicate that the UCP injected itself into the resource request and 
allocation process. After the transition from the ICP, representatives from the UCP began 
bypassing the State EOC. The UCP became an independent node in the Connecticut resource 
allocation process. Rather than submitting resource needs to the State EOC, the UCP assessed 
Connecticut’s needs and submitted requests for support directly to organizations in the Federal 
government and other States.^** Figure 1II-4 details the relationships among organizations 
participating in the Connecticut resource request and allocation process. 


Some of the requests sent by the UCP to the JFO were handled appropriately under the National Contingency Plan 
authority and under the NRP's Federal-to-Federal response mechanism (i.e., a fourth resource process). The 
addition of another resource request channel increa.sed confusion among the participants. 
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Figure lH-4. T3 FSE Connecticut Incident Management Structure 


CT Department of 
Public Health 
Emergency 
Coordination Center 



The UCP’s participation (i.e., the addition of another node) in the resource request process made 
it difficult for participants to coordinate their activities. This structure did not facilitate the 
orderly exchange of requests because there was no mechanism (i.e., a gatekeeper) that could 
manage all requests, deconflict similar requests, and answer questions. Planners and decision 
makers had to rely on a patchwork of reports concerning resource requests. 

The analysis of the resourcing process in New Jersey and Connecticut indicates that three 
different processes were used to provide Federal resources to the States and these processes were 
not well-coordinated. This lack of coordination helps to explain why key resourcing 
organizations, such as the New Jersey State ECXT, IIMG, HHS. and the JFO, had such different 
resource pictures (refer to Table 111-4). In both States, there was no mechanism that managed the 
flow of requests from the State and the flow of resources from the Federal government. 
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4. Implementation of Resourcing Processes by Slate and Federal Officials 

Observations made during the exercise indicate that neither Federal nor State officials fully 
understood the processes for accessing Federal support. When documenting some requests. State 
officials either omitted key information or requested specific resources, rather than capabilities. 
Several requests were returned because the State was not familiar with the capabilities of the 
assets it was requesting. The processing of requests was also problematic and the outcomes of 
many New Jersey requests remain unresolved. In both States, there was uncertainty about who 
had asked for what. It is not clear whether the information was communicated to either system. 

5. Problems with Request Documentation 

Many resource requests were too specific and/or lacked important information. For example, 
Connecticut requested 3-5 refrigerated trucks to transport/store 100 bodies. Similarly, the 
Connecticut request for the Quick Reaction Force (QRF) stated a need for a “company size 
element of Federal troops numbering 100-120.” The first request should have included the 
location(s) of the bodies requiring transport and their destination(s). As for the second request, an 
appropriate way to request the QRF would have been to describe the requirement to secure a 
nuclear power plant, rather than requesting a particular unit. The request should also have 
included details about the expected mission and its duration, which Connecticut did not specify. 
In several other requests, Connecticut stipulated the source of the asset (e.g., DMORT, DMAT, 
or DoD security) instead of asking for the type of assistance or capability required. Requests that 
lacked specifics included one that simply asked for an “additional quantity of supplies from 
HHS” and one for “mental health counselors, psychologists, and social workers to provide 
psychological aid in hospital emergency departments.” Neither included details needed to fulfill 
the request, such as the types of medical supplies required, the number professionals needed, the 
locations, or the expected duration of the mission. 

More than once, Connecticut asked for an asset without a good understanding of what capability 
came with it, In a discussion between the State EOC and JFO about the options for increasing the 
number of medical professionals, the State EOC had to ask what a DMAT could do. The 
response to a State request for DMORT to remove 100 dead bodies, 20 of which were 
contaminated, was that DMORTs do not handle contaminated bodies. Similarly, Connecticut’s 
request for mortuary assistance included both DMORT and refrigerated trucks, although 
DMORTs bring their own temporary morgue facilities. A request to the National Guard for 
explosive ordnance disposal support was returned because the National Guard does not have this 
capability. 

6. Officials Unfamiliar with the Processes 

At times. State and Federal officials were also uncertain about how to process requests. Despite 
statements from the Connecticut EOC that all requests for Federal resources would be 
coordinated through the State EOC, confusion about how to access Federal assets persisted 
among State agencies. In a teleconference on April 4, a Connecticut Department of Public Health 
(DPH) representative in the State EOC called the DPH for clarification on how to request HHS 
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assistance. There was also evidence that Connecticut officials were unfamiliar with the ESF 
structure and to whom resource requests should be sent at the JFO. One data collector log noted 
that DPH staff members at the State EOC thought that ESF #8 (Public Health and Medical 
Services) was a form, rather than part of the JFO. This lack of familiarity may explain why 
requests were sent directly to different entities within the JFO and PFO cells. The same request 
for medical support was sent by the State EOC directly to a DoD representative (presumably at 
the JFO). another to the ESF #8 desk, and yet another to the PFO. In another example, requests 
were sent directly from representatives in the State EOC to the JFO without the knowledge of the 
Operations Chief within the State EOC. The result in Connecticut was uncertainty about who had 
asked for what. 

Several of the requests submitted by State officials in Connecticut were not resolved during the 
exercise. During the T3 FSE, Connecticut officials submitted at least 12 requests, but mission 
assignments were issued for only 7 of these requests. The remaining 5 requests were unresolved. 
Table II1-5 lists these 12 requests and the outcome of each request. 


Table III-5. Matching Connecticut ARFs with JFO Mission Assignments 


Resource Requested by State Using an ARF 

Federal Action Taken 

State DMAT 

Asset provided 

Federal DMAT 

Asset provided | 

Medical Rc.serve Corps 

Asset provided | 

Out-of-state hospital capacity 

Asset provided | 

Nation-wide ho.spital capacity 

Unresolved 

Rapid Response Registry 

Unresolved 

Patient movement in-state 

Unresolved 

Patient movement out-of-state 

Unresolved 

Ventilators/dilators 

Unresolved 

Refrigerated trucks 

Asset provided 

DMORT 

Asset provided | 

Federal Quick Reaction Force (QRF) 

Asset provided 


The number of unresolved requests in Connecticut suggests that the mission assignment process 
was not able to meet the needs of the State’s response. 

Uncertainty about the resourcing processes may help explain why a large number of State ARFs 
were not resolved during the exercise. In New Jersey, the State EOC submitted 43 ARFs, but 24 
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were not resolved during the exercise. The JFO made nine mission assignments in response to 
the New Jersey ARFs. The remaining ten ARFs were canceled, rejected, superseded, or provided 
by National Disaster Medical System (i.e., outside the mission assignment process). The large 
number of unresolved resource requests noted in New Jersey indicates that the mission 
assignment process broke down during the exercise, leaving many State resource needs unmet. 

Uncertainty about the resource request and coordination process may have caused officials in 
New Jersey to submit several ARFs requesting similar resources. It is unclear whether the State 
was requesting additional resources or simply updating earlier requests. For example, the State 
submitted three requests for mental health workers to support POD operations. In separate 
requests, the State requested 2,000, 1,500, and 500 crisis counselors. From these ARFs, it is not 
clear how many mental health workers the State was requesting. A similar problem arose over 
POD security. The State submitted six different ARFs requesting POD security. At various times 
during the exercise, the State requested: 

• armed security for the PODs (n = 1 ,826); 

• POD security (n = 2,350); 

• POD security (n = 4,000); 

• POD security (10 per POD, n = 1,680); 

• POD security (20 per POD); and 

• security to protect the State’s 200 PODs (n = 4,000). 

It is unclear exactly how many POD security personnel the State was requesting. The numerous 
submissions also made it difficult to discuss security resources because, among staff members, it 
was difficult to discern which requests were being discussed. 

Uncertainty about the process was not limited to State officials. In Connecticut, the Operations 
Chief in the JFO expressed concern that ESF #8 was processing requests made directly to them 
by the State EOC at the same time that the JFO Operations Branch was processing the same 
requests. This led to a discussion about procedures and the pronouncement that all requests 
should be formally made through the FCO. 

As in Connecticut, officials in New Jersey were not familiar with the resource request and 
allocation process. The observations summarized in Table 111-6 indicate that staffs at Federal 
sites in New Jersey encountered problems with the resourcing process. 


39 


The daily distribution of ARFs submitted to the New Jersey JFO was: April 4=1, April 5=4, April 6=18, April 
7 = 17, April 8=0, and Unknown = 3 . 
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Table 111-6. Resource Request and Allocation Process Issues at Federal Sites in New Jersey 


Time/date 

Location 

Data Collector Ob.servatlons 

23:58 April 4 

ERT-A 

The DMORT request is halted, because the SERT thought that the request had to 
be vetted through HHS. Later clarified that the DMORT is a FEMA asset. 

17:50 Aprils 

RRCC 

The Operations Chief requests that ESF #8 find out what they are doing under 

HHS funding and what is being done under Stafford Act. 

22:20 April 5 

RRCC 

There is a disconnect between what is being conducted in the ESFs and what the 
RRCC Director and Operations Chief are aware of. 

06:30 April 6 

JFO 

It does not seem that anyone in this section knows the correct way to submit 
properly filled out ARFs. 

13:45 April 6 

JFO 

The JFO was trying to figure out how an ARF was submitted and approved for 
the 10,000 bed facility without consulting the Slate or FEMA. The SERT 
indicated that HHS requested the facility for New Jersey. 

16:10 April 6 

JFO 

The Mission Assignment staff wants to know the origin of the request for the 

Army Corps of Engineers to provide power and shelter for citizens. 

17:30 April 6 

JFO 

The Operations Chief is requesting from all Branch Chiefs and ESFs what the 
latest information is on all mission a.ssignment — wants status on all. 

18:30 April 6 

JFO 

It does not appear that anyone in this section knows the process for completing 
and submitting ARFs. 

09:30 April 7 

JFO 

ESF #7 is being directly tasked by FEMA Headquarters without going through 
the FCO. 

16:00 April 7 

JFO 

The JFO staff does not know how HHS fits into the resource allocation process. 

The ARF/MA process is broken. 

17:45 April 7 

JFO/SERT 

SERT Operations Chief comes into JFO and introduces himself to the JFO 
Operations Chief SERT Operations Chief asks how exactly they can get the 
items they need. 

17:50 April 7 

JFO/SERT 

ESF #8 staff consulted with SERT Captain regarding why mission assignments 
are coming from the SERT if HHS is directly funding these resources. It appears 
that the SERT is submitting ARFs to ESF #8 to pass to the JFO Operations Chief 
for items that have already been completed using HHS resources. The JFO wants 
to understand why the SERT is using a FEMA process — confusing. 

08:00 April 8 

JFO 

JFO Operations Chief is discussing how to clarify the process of receiving ARFs 
and entering them into a tracking log. 


The observations in Table IiI-6 indicate that personnel from the RRCC, JFO, and SERT were 
confused by the operation of multiple, overlapping resourcing processes. This lack of familiarity 
is problematic because these personnel are expected to manage the Federal resource process in 
the State. This lack of familiarity with the mission assignment process may explain why so many 
State requests were unresolved at the end of the exercise. 

UNCLASSIFIED 

This Document Contains Canadian and United Kingdom Information 

118 













































AAR 


FO R OFF I CIAL USE ONLY 


TOPOFF 3 


7. Information about Resourcing Process Not Readily Available 

Throughout the exercise, participants from both State and Federal agencies did not have access 
to current information about the status of resource requests or about the deployment of 
unsolicited assets. Information that was available about what had been requested, the status of 
these requests, and the arrival of Federal resources was often incomplete and outdated. This lack 
of transparency (e.g., the ability to track a request from submission through delivery) made it 
difficult for State and Federal officials to access information about: 

• which resources had been requested and by whom; 

• the status of the requests (e.g., received and under review); 

• the outcomes of these requests (e.g., denied, approved, or modified); and 

• the status of the resource (e.g., mobilizing, en route, or arrived). 

Without access to reliable information, response planners and decision makers lacked a key 
element of situational awareness. For example, the reconstruction of the T3 FSE events indicates 
that the New Jersey PFO Cell was not aware of many New Jersey resource requests, At a 1500 
briefing on April 6, the PFO Cell reviewed the status of resource request submitted by the State. 
In this meeting, the PFO Cell noted that New Jersey had requested: 

• SNS support; 

• DMAT: 

• DMORT; 

. NDMS MST; and 

• DPMU. 

The PFO Cell’s list of requests differs from the list of submitted ARFs provided by the New 
Jersey State EOC. A review of the State EOC ARFs submitted by 1200 on April 6 indicates that 
in addition to the items listed above, the New Jersey EOC had submitted additional ARFs for the 
following: 

• VMAT: 

• 80-100 epidemiological investigators; 

• 12,000 medical personnel to support acute care facilities; and 

• 8 pathologists. 

Such differences suggest that reliable information about State resource requests was not readily 
available to officials in New Jersey. Similar issues were observed in the New Jersey JFO Cell. 
Data collectors noted resource request confusion on at least eight occasions. In Table 111-7, 
several examples of this confusion are provided. 
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Table III-7. Confusion Regarding New Jersey Resource Requests 


Time/Date 

Data Collector Observations 

04;03/April 7 

There are len ARFs being played by the DCO with no play from the ESFs. There is confusion 
over who is doing these ARFs. Nothing has been passed to the Operations Chief about who is 
handling them. 

04;06/April 7 

There are questions regarding who is responsible for purchasing the 100 refrigerated trailers. 

04;50/April 7 

The JFO Operations Chief and the Deputy Federal Coordinating Officer were trying to 
resolve who is in charge of the CDC Vector Control Team and who is paying for them. 

07;00/April 7 

The State is sending duplicate ARFs to the JFO forcing the Operations Chief to sort through 
them to identify those ARFs that are already in process. 

08;00/April 7 

The Operations log indicates that new ARFs came in during the night shift, but many are 
duplicates and some have been returned to be reworked. 

19;15/April7 

NJ HOC had to resubmit an ARF for a VMAT because the first had been lost. 

April 7 

ARFs went directly to the ESFs. 

08;00/April 8 

Several (9) ARFs received at the JFO during the night shift are una.ssigned. The JFO is still 
receiving duplicate requests. 


A lack of understanding about what had been requested at the JFO Cell is particularly 
troublesome because managing the resource allocation process is the primary function of the 
JFO. 

Similar issues existed in Connecticut, At the operational level, officials realized that information 
about resource requests had not been adequately maintained and were not readily available. For 
example, the Logistics Chief at the RRCC remarked to the Operations Chief that it was unclear 
to him what, if anything, had been done on State resource requests. State officials echoed these 
sentiments. The Operations Chief at the State HOC commented that he never knew if or when 
requests were addressed by Federal authorities. The State Logistics Chief added that he could not 
distinguish new requests from clarifications of previous requests. 

Such observations suggest that information about resource requests and deployment was not 
readily available to officials in New Jersey and Connecticut. 

8. Issues from Previous Exercises 

Many of the same issues observed during T2 regarding the resourcing process recurred during 
the T3 FSE. In at least one area, the issue may have worsened. In the T3 FSE, information about 
the process of requesting resources was not documented in the National Response Plan (NRP). 
The document that preceded the NRP and was in use during T2, the Federal Response Plan, 
included a thorough description of the process. 
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In Table III-8, a comparison of the T3 FSE resourcing process with the T2 experience is 
provided. 


Table 111-8. Comparison of T3 FSE with Previous Exercises 


T2 FSE 

T3FSE 

tSSUES/OBSERVATiONS 


• Considerable uncertainty existed at the local and State 
levels about available Federal assets and the processes 
for obtaining them. 

Stales often requested specific assets— sometimes 
requesting inappropriate or t/nnecessa/y assets by error. 

Stales appeared not to be aware of the range of Federal 
resources potentially available 



• state and Federal officials struggled with the 
implementation of the Federal resourcing process. 



• State and local agencies requested resources through a 
number of different channels directly from the Federal 
departments/agencies and also through the FEMA 
mission assignment process. 

Direct requests for Federal assistance occurred before 

Stafford Act declarations (e.g. Washington State requested 
assistance from DOE in response to the ROD attack). 

w 

• The use of multiple resource processes created 
uncertainty and adversely affected situational 
awareness. 



• A complete and consistent source of Information about 
deployed Federal assets was not available. 

w 

• Information about the status of resources was not 
readily available and the process lacked transparency. 


• The rote of the HHS SERT was not well'defined or 
understood by participants. At times the SERT 
duplicated functions performed by ESF #8 In the JFO. 


The comparison of the T2 and T3 experiences suggests that there has been little improvement in 
the process of matching Stale needs with Federal assets. 

E. Conclusion 

During the T3 FSE, officials in New Jersey and Connecticut requested Federal support; however 
the resource request process used in this exercise was problematic. At least three different 
resource processes were used during the exercise and the activities of those supporting each one 
were not welt-coordinated. Officials struggled with implementing the process, many requests 
were unresolved, and information about the status of requests was not available. Additionally, 
the role of the HHS SERT was not well-defined or understood by the participants. Together, 
these factors adversely affected the ability of State and Federal officials to match State needs 
with available Federal assets. Resolving these issues would clarify the process and strengthen the 
ability of Federal and State agencies to respond to a major disaster. 
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The use of multiple resource processes created uncertainty and adversely affected situational 
awareness. State and Federal efforts would likely benefit from a simplified resourcing process. 
Developing a unified Federal emergency resourcing process would likely address many of the 
coordination and situational awareness issues observed during the T3 FSE. 

State officials struggled with the implementation of the Federal resourcing process. Integrating a 
team familiar with the Federal resource allocation process into a State HOC would likely 
improve the State’s ability to access the Federal resources it needs. Such an organization (e.g., 
ERT-A) already exists, but its impact on the T3 FSE resource process is unclear. The ERT-A is a 
deployable FEMA organization familiar with JFO operations. In New Jersey, the ERT-A 
deployed to the State EOC. In Connecticut, the ERT-A deployed to the JFO. The analysis of the 
T3 FSE observations indicates that officials in both venues struggled with the resource request 
process. It is not clear that the ERT-A in New Jersey improved the State's ability to access 
Federal resources. One difference between the two venues is that New Jersey submitted 43 ARFs 
and Connecticut submitted 12: however, this difference could be caused by a number of factors 
and exercise artificialities. Nevertheless, observations from the T3 FSE indicate that States 
require substantial support and guidance on the Federal resource request process. 

Information about the resource process(es) was not readily available. Both Slate and Federal 
officials would benefit from readily available and clear documentation on the mission 
assignment process. Although the NRP makes numerous references to the mission assignment 
process, few, if any, details of the process are provided in the document. Without guidance from 
the NRP. State and Federal officials must locale other sources of information about how the 
Federal government provides disaster assistance to States. During such emergencies, officials 
have little time to thoroughly research the process. In the T3 FSE, State and Federal officials 
learned about the process while attempting to engage and/or implement it. 

The documentation that describes the mission assignment process should be crafted so that even 
those officials with limited exposure to the process and little time to learn can successfully 
participate. The information should be clear and concise. Although Federal officials may have 
many opportunities to participate in and learn about the mission assignment process. State 
officials will likely have far fewer opportunities to do so. 

The role of the HHS SERT was not well-defined or understood by the participants. In the T3 
FSE, the HHS Secretary activated the SERT in both New Jersey and Connecticut, despite the 
fact that a public health emergency was declared only in New Jersey. Observations from New 
Jersey indicate that its presence adversely affected the resourcing process. 

There are at least two alternative roles that the SERT could fulfill during a crisis that involved 
multiple Federal agencies: augment the ESF #8 or deploy to the State’s Department of Health. 
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The T3 FSE analysis indicates that in situations in which the Stafford Act mission assignment 
process is being used, both ESF #8 and the SERT do not need to be present because they 
performed nearly identical functions in the exercise (i.e.. coordinate Federal medical resources). 
This conclusion suggests that when the JFO stand.s-up and ESF 8 activates, the SERT should 
either augment the ESF #8 staff or not deploy to the JFO. This approach would benefit the 
resource allocation process by: 

• clarifying the process for acces.sing Federal resources; 

• reducing coordination requirements (one less node in the resource request structure); and 

• infusing ESF #8 with an experienced staff of subject matter experts. 

The T3 FSE experience indicates that maintaining the SERT and ESF #8 as separate entities, as 
they were in the T3 FSE, will preserve a source of confusion that will adversely affect the State's 
ability to access Federal resources during a major disaster. 

A second alternative to deploying with the JFO would be for the SERT to deploy to the State's 
Department of Health or other location at which the SERT could provide subject matter expertise 
needed for the response, including expertise about Federal medical resources, and advise the 
State health officials how to request those assets. Such a mission would require the SERT staff to 
become more familiar with the Federal resourcing process. 

Access to information about the status of resources would help the State plan their response; 
however, such access was not available during the T3 FSE. Throughout the exercise, both 
Federal and State officials asked a version of the same question over and over again: What is the 
status of the State’s resource requests? Many of those participating in the response had little 
insight into the process and were not notified when a request was received, approved, denied, or 
modified. The lack of access to the status of resource requests limited the ability of response 
organizations to incorporate Federal resources into their response plans. 

During the exercise, the JFO maintained at lea.st two logs of mission assignments, but it is not 
clear the extent to which State officials had access to either log. There are no observations 
indicating that State officials had access to or used either log. Even if they did, the logs are 
incomplete; several State requests do not appear in either log. State officials also did not have 
access to information about the deployment of unsolicited resources from the Federal 
government. 

Access to information about the status of resources requests and the deployment of all resources 
is an essential element of situational awareness among State and Federal officials during major 
disasters. During the exercise, these officials devoted large amounts of time and effort to the 
resourcing process. Documenting this process and its results during the T3 FSE would have 
contributed important information to the participants’ situational awareness. 

Providing the information needed to support resource allocation awareness does not require an 
extensive infrastructure or an elaborate process. A readily available, authoritative spreadsheet 
containing a few pieces of information (e.g., a description of the requested/deployed resources, a 
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JFO point of contact, and the status of the request) would provide officials with significant 
situational awareness. Once again, a simple process and an accessible mechanism for sharing 
information would be sufficient. For example, the JFO could attach the resource request 
spreadsheet to a regular update that it e-mails to a large number of State and Federal officials. 
This authoritative update would become the basis for situational awareness about the resourcing 
process. Such a simple solution is more likely to be used by State officials who may have few 
opportunities to learn about the Federal resourcing process and the information sharing 
mechanism. 

]. Recommended Courses of Action 

• Develop a unified Federal emergency resourcing process that supports resource 
requests from the State under the Stafford Act and resource requests for Federal-to- 
Federal support under other Federal authorities. Include a description of how resource 
request/status information will flow between the Incident Command Post(s) and the 
JFO. 

• Provide States with a team of subject matter experts, who are knowledgeable on 
Federal capabilities and the resource requesting process itself. 

• Document the mission assignment proce.ss more thoroughly in the NRP. 

• Clarify the role of the SERT during emergencies. Consider using the SERT to 
augment ESF #8 at the JFO or deploying it to the State Department of Health to 
provide subject matter expertise in identifying and requesting Federal medical 
support. 

• Make information about resource requests readily available, including what resources 
or capabilities were requested, who made the request, how the request is being 
funded, and its current status. 

lY. Information Sharing 

A. Introduction 

Accurate and timely sharing of information and the development of a common operational 
picture are critical for the success of an integrated Federal, State, and local response to domestic 
emergencies. Despite efforts to improve communications and information sharing across 
response organizations, the lack of shared situational awareness and the dissemination of 
incorrect information remain significant roadblocks to a coordinated emergency response, as 
evidenced by experiences in the T3 FSE. 
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Previous sections of the AAR touched on information sharing 
and coordination problems associated with resource 
requesting and coordination.''^ agent identification,'" status 
of advisory levels,''^ and integration of operating centers into 
the response/^ among others. The following discussion 
focuses on some additional examples of inadequate 
information sharing that affected T3 operations from the 
tactical to the strategic levels of the response, and then 
proposes some broad explanations as to why communications 
broke down in these and other cases. 

Analysis of information sharing in T3 suggests a number of 
contributing factors to the information sharing problems 
observed during the exercise, including: 

• proliferation of stovepiped electronic information 
systems; 

• presence of many nodes in the respon.se network; 

• lack of formal information flow processes and the use 
of alternative channels; and 

• lack of uniform reporting guidelines and established 
procedures for validating information to build shared 
situational awareness and a common operating picture 
(COP). 


Summary of Conclusions: 

Information Sharlng in the T3 FSE 

• Informalion systems used in T3 were 
largely stovepiped within agencies and/or 
response communities. 

• The vast number of operating centers 
activated during T3 negatively affected 
information .sharing by increasing the 
scope and complexity of the problem. 

• "Hie use of informal or alternate channels 
for sharing information caused problems 
by enabling circular reporting and 
bypassing authoritative sources. 

• The T3 FSE revealed a lack of uniform 
reporting guidelines and procedures for 
validating information received from 
secondary or lerliary sources. 

• Agencies and operating centers acted and 
made decisions on different informalion 

• Situational awareness was not effectively 
shared across operating centers and 
agencies. 


The result of information sharing problems in the T3 FSE was that shared situational awareness 
was not achieved nor was a COP developed and effectively shared across the response network. 
Instead, agencies and operating centers in T3 were often making decisions and acting on 
different information. 


B. Background 

Shared situational awareness is the synthesis of information across organizations or among 
individuals used to generate a common bank of knowledge about an incident or situation. The 
concept of shared situational awareness does not necessarily imply perfect information, though 
that is the goal, but rather common information, be it good or bad, shared by all persons or 


See discussion in “Resource Requesting and Resource Coordination.” 

■*' See discussion in “Agent Confirmation and Hazard Area Determination.” 
See discussion in "Homeland Security Advisory System.” 

See discussion in “Joint Field Operations.” 


UNCLASSIFIED - FOU O 

This Document Contains Canadian and United Kingdom Information 

125 






AAR 


FO R OFF I CIAL USE ONLY 


TOPOFF 3 


organizations. Part of shared situational awareness is building a COP. Most definitions of a COP 
imply a physical or technological display of information accessible by all the paities. This 
picture facilitates collaborative planning by visually presenting information relevant to achieve 
shared situational awareness. Key to developing a COP and shared situational awareness is an 
understanding of an incident’s or operation’s essential elements of information (EEIs), or the 
significant pieces of information that need to be shared. Some EEIs can only be tracked with 
words, not pictures. 

Casualty figures and the means by which contaminating agents were disseminated are EEIs in an 
emergency response. These data drive decision making at multiple levels and across different 
communities. 

• The numbers of persons injured, sick, and dead are used for predicting resource 
requirements including hospital beds, ventilators, and mortuary services; for supporting 
any epidemiological investigations; for determining prophylaxis requirements: and for 
framing Federal support to a region. State, or locality. 

• Information on a contaminating agent and how it was released Is used for supporting the 
criminal investigation, for predicting the spread of contamination, for assessing 
remediation requirements, and for determining public safety measures. 

In a domestic emergency response operation, operating centers and agencies at the local, State, 
and Federal level develop their own situational awareness of the incident, and then strive 
throughout to align their knowledge with that held by other centers or agencies. In other words, 
they create their own operational picture, then constantly update and validate it with information 
gleaned from other responders, thereby building a COP. The NRP identifies the Homeland 
Security Operations Center (HSOC) as the national hub for information sharing and tasks that 
center with maintaining situational awareness. 

C. Reconstruction 

During the T3 FSE, Operations Centers across the response network frequently held 
contradictory information about casualty figures and the means by which terrorists released the 
mustard agent in Connecticut. 

y. Victim Numbers 

The first casualties from the T3 FSE terrorist attacks appeared in New Jersey at 08:00 on 
Monday, April 4, when three victims were admitted to hospitals in Union and Middlesex 
Counties, New Jersey. Showing flu-like symptoms and coughing up blood, these victims marked 
the first of many casualties from the overnight release of Yersinia pestis along the State’s 
highways. Using a credible epidemiologic model, T3 planners were able to project the numbers 
of plague casualties both temporally and geographically. According to the model, by the end of 
the first day, over 900 people were .sick and another 900 dead from pneumonic plague. Within 
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four days, over 60,000 Stale residents were sick, and 9,500 people were dead. Table IV-1 shows 
the ground truth numbers of plague deaths between April 4 and 8. 

Table IV-I. Persons Dead from Plague in New Jersey (Ground Truth 


Date and Time 

Total Dead (Cumulative) 

Monday, April 4, Noon 

92 

Monday, April 4, Midnight 

909 

Tuesday, April 5, Noon 

3,077 

Tuesday, April 5, Midnight 

5,692 

Wednesday, April 6, Noon 

6,509 

Wednesday, April 6, Midnight 

8,071 

Thursday, April 7, Noon 

8,490 

Thursday, April 7, Midnight 

8,839 

Friday, April 8, Noon 

9,181 

Friday, April 8, Midnight 

9,554 


Figure IV- 1 shows the number of fatalities that were reported by various sources in New Jersey, 
the Federal government, and the media compared to the ground truth as injected by exercise 
control based on the epidemiological modeling. 


Note that the dates and times are based on planned injects by exercise control. Data is insufficient to prove 
whether injects occurred precisely as planned. 
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Figure IV-I. Fatalities from Plague in New Jersey 
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In Ihe chart, the black line bounding the data-points corresponds to the ground truth as injected 
by the controllers. The gray stair-step line corresponds to what the ground truth would appear to 
be with numbers injected in 12-hour intervals, as they were once hospital play concluded prior to 
midnight on April 4. The points on the chart that are not in agreement with the ground truth fall 
into two main categories — “late” and “other.” 

The late points are those that match injected ground truth fatality numbers, but were reported 
after new injects. On the chart, the late points fall on a line horizontal to the inject, but after a 
stair-step riser indicating a new inject. For example, there are at least eight points that correspond 
to the 6,508 fatality deaths injected at 12:00 on April 6. These eight points fall on a horizontal 
leg of the ground truth stair-step line, to the right of the 4/6/05 12:00 and 6,508 point; therefore, 
these reports were timely and accurate, falling as they do before new numbers were injected into 
play. The chart shows, however, that there were four more reports of 6,508 deaths, by the FEMA 
ERT, the CDC. and DHS. all of whom were reporting or working from out-of-date information. 
Data points that fall under the “other” descriptor are those that do not align with any ground truth 
data on a horizontal access. 

Figure IV- 1 indicates that the lack of a common and accurate fatality count in New Jersey was 
largely an is.sue of late reporting. Except for a few instances, agencies and operating centers 
appeared to report fatality numbers that aligned with figures that were, at the very least, accurate 
at some point during the exercise, if not at the moment they were reported. This suggests a 
problem with keeping all operating centers and agencies updated with new information. 

Victims of the terrorist attack in Connecticut included persons injured or killed in the tnick 
bombing on the New London City Pier and those contaminated by mustard dispersed from an 
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airplane prior to the explosion. Over 100 people were killed and another 300 wounded in the 
bombing. The mustard attack resulted in the hospitalization of over 5,600 people, with close to 
50,000 more filling hospital waiting rooms fearing they had been contaminated. Table lV-2 
shows the ground truth numbers of people hospitalized for mustard exposure as a result of the 
Connecticut attack. 


Table IV-2. Victims Hospitalized in Connecticut (Ground Truth)^^ 


Date and Time 

Total Hospitalized (Cumulative) 

Monday, April 4, 15:30 

429 

Monday. April 4, 16:30 

835 

Monday, April 4, 17:30 

1,119 

Monday, April 4, 18:30 

1,327 

Monday. April 4, 19:30 

1,587 

Monday, April 4, 20:30 

1,906 

Monday. April 4, 21:30 

2,220 

Monday, April 4, 22:30 

2,469 

Tuesday, April 5, 00:30 

3,351 

Tuesday, April 5, 04:30 

4,086 

Tuesday, April 5, 08:30 

4,674 

Tuesday, April 5, 12:30 

5,115 

Tuesday, April 5, 16:30 

5,409 

Wednesday, April 6, 08:00 

5,508 

Wednesday, April 6, 16:00 

5,579 

Thursday, April 7, 08:00 

5,644 


Figure lV-2 shows the number of victims hospitalized for mustard exposure as reported by 
various sources in Connecticut, the Federal government, and the media, compared to the ground 


Note that the dates and times are based on planned injects by exercise control. Data are insufficient to prove 
whether injects occurred precisely as planned. 
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truth as injected by exercise control. In the Connecticut portion of the T3 FSE, new casualty 
numbers were not injected in a consistent pattern as they were in New Jersey. 

Figure IV-2. Victims Hospitalized for Mustard Exposure in Connecticut 



< 2tOO 1g:00 0:00 0:00 12:00 « l:00 0:00 «:00 12:00 10:00 0:00 6SM 12:00 

Tim* 
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The reported ho.spitalizaiion numbers from Connecticut .show more discrepancies across 
reporting agencies and as compared to the ground truth than did the New Jersey fatality data. 
Few of the differences in casualty reporting in Connecticut appear to be attributable to late 
reports. Instead, the reported hospitalization numbers are widely dispersed across time and 
operating centers. 

2. Agent Release 

The terrorists used two methods to disseminate the mustard agent in Connecticut. First, at 
approximately 11:20 on April 4, a small aircraft flew over the New London City Pier on the 
Thames River releasing mustard over the waterfront area. Roughly two hours later, at 13:20. a 
vehicle-borne improvised explosive device (VBIED), hidden in the back of a truck that also 
carried mustard, detonated at the head of the pier. Most of the mustard agent present in the truck 
bomb was destroyed during the explosion, limiting contamination to the immediate vicinity of 
the detonation, where a pool of mustard had collected prior to the explosion. The aircraft release 
contaminated a much larger area and had a greater impact on the people attending the festival at 
the pier. 

First responders and hazardous material .specialists at the incident site quickly recognized that 
victims were showing symptoms beyond those expected after a bombing. Most responders 
assumed that the truck itself was responsible for the contamination. The investigation into the 
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attack in Connecticut progressed rapidly. Interviews with victims revealed that most reported 
feeling ill prior to the explosion and remembered seeing a low flying aircraft leaking an 
unknown substance over the pier roughly two hours before the bombing. This led the FBI to 
investigate five small aircraft matching witness descriptions that were reportedly in the area on 
April 4. Over the course of a few hours, law enforcement personnel had contacted and 
interviewed the owners or pilots of all but one of the aircraft, a Beechcraft Baron 58, owned by 
three individuals as part of a timeshare. At 14:20, the FBI was advised that an airplane matching 
that description had landed at a private airstrip in Millbridge, Maine, under suspicious 
circumstances and with a steel drum inside. At 15:35, the senior investigator at the Connecticut 
JOC sent agents to Maine to investigate the aircraft. The search of the aircraft began at 17:00, 
and by 17:13, investigators had located the steel drum and were testing it and the aircraft for 
signs of mustard. At 22:00, the FBI Senior Agent in Charge (SAC) informed the Primary Federal 
Official (PFO) and the other members of the JFO Coordination Group that initial tests on the 
aircraft were positive for mustard, but that definitive confirmation would not be available until 
the next morning. At 10:00 on April 5, the Connecticut JOC informed the FBI's Strategic 
Intelligence Operations Center (SIOC) that test results on the aircraft were positive for mustard. 
The confirmation was briefed within the JOC at 12:00 and posted to the Law Enforcement 
Online (LEO) system at 14:05. 

Unaware of the FBI’s investigation into the suspicious aircraft, other agencies hypothesized 
about the means of dispersal. At 18:08 on April 4, the Connecticut Department of Public Health 
(DPH) and the treating hospitals reasoned that the timetable in which victims became 
symptomatic was loo quick for the mustard to have been released in the explosion, suggesting 
the agent was released prior to the explosion (or was not mustard). The next morning, at 06:20, a 
representative from the Connecticut DPH also expressed skepticism that the ten-gallon container 
discovered in the debris from the truck bomb could produce the number of casualties being seen 
at area hospitals. Representatives from the Environmental Protection Agency (EPA), located at 
the JFO, considered that a blast strong enough to destroy a five-story building would likely have 
destroyed any mustard present. The Interagency Modeling and Analysis Center (IMAAC) 
determined from the initial set of field measurements, injected at 19:30 on April 4, that the bulk 
of the contaminant had to have been released from an airplane; this scientific conclusion was 
included in Set 4 of the IMAAC products, released at 23:50 on April 4. 

Despite these hypotheses, scientific evidence, and the FBI’s ongoing investigation, between 
03:00 on April 5, and the conclusion of the T3 FSE on April 7, numerous agencies and operating 
centers incorrectly reported or believed that the aircraft found in Maine had tested negative for 
mustard and was likely not responsible for the chemical release over the New London City 
Pier."*^ Table lV-3 identifies the agencies, their incorrect assumptions, and when they were 
corrected relative to the 10:00 confirmation that the aircraft was positive for mustard. 


Data suggest that the initial genesis of the incorrect informalion about the aircraft was the result of controller 
error. However, the spread of bad information and the inability of operating centers and agencies to successfully 
correct the mistake across the response network are worth analyzing. 
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Table IV-S. Misinformation about the Aircraft that Released Mustard 


Agency/ 

Operating 

Center 

Time of 
Incorrect 
Assumption 

Incorrect Information 

Time When 
Corrected 

Time Since FBI 
Confirmed 
Mustard on 
Aircraft 

CT PFO/ JFO 
CG 

April 5, 03:00 

FBI Boston examined aircraft in Maine and 
determined it was only equipped with 
normal crop dusting equipment, and that all 
other forensic tests yielded negative results 

April 5, 

11:50^’ 

1 hr, 50 min 

UCP 

April 5, 04:09 

Airplane in Maine was a red herring 

April 5, 

13:05 

3 hrs, 5 min 

USCG 

Aprils, 04:18 

FBI reported the inspection of the aircraft 
resulted in no evidence of mustard 

April 5. 

16:17 

6 hrs, 17 min 

IIMG (DHS 
S&T) 

April 5. 07:28 

FBI reported positive identification of 
mustard on the ground in Connecticut but 
only precursors on the aircraft. Instructed 
the IMAAC to ignore the aircraft and focus 
on the truck as the source of the mustard. 

April 5, 

14:22 

4 hrs, 22 min 

CT DEP 

April 5, 09:45 

Local FBI determined the aircraft was a 
false lead. Requested IMAAC plume 
analysis for truck-based release. 

April 5, 

10:53 

53 min 

HSOC 

April 5. 10:27 

A drum in the aircraft tested positive for 

HD. However, on further examination it was 
determined that the aircraft was only 
equipped with normal crop dusting 
equipment. All other forensic examinations 
yielded negative results. 

April 5, 

14:22 

4 hrs, 22 min 1 

TSA 

April 5. 15:00 

FBI analysis of the drum on the aircraft in 
Maine yielded no trace of mustard, (as 
reported in DHS/PFO SITREP)^ 

Unknown 


FEMA RRCC 

April 6, 09:(K) 

Vehicle bomb appears to be primary 
dissemination device. 

Unknown 


OS HA 

April 6, 15:00 

Mustard disposition assumptions not 
established, (as reported in DHS/PFO 
SITREP) 

Unknown 

— 


Despite data indicating the JFO Coordination Group was told at 1 1 ;50 on April 5, that the aircraft tested 
definitively for mustard, members continued to question the validity of that information through the end of the 
exercise. 

The 15:00 SITREP from the Connecticut DHS/PFO contained contradictory information, with the TSA section 
reporting the aircraft yielded no trace of mustard and the FBI section reporting the aircraft tested positive for 
mustard. 
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D. Analysis 

Shared situational awareness is essential for the successful integration of Federal, State, and local 
operations during an emergency response. The T3 FSE demonstrated examples of both 
successful and less than successful information movement and coordination, many of which are 
described throughout this AAR. To improve on integrated responses to national emergencies, it 
is important to understand what does and does not work in terms of information flow, where 
information sharing tends to break down, and what actions or events influence the information 
sharing processes. 

Analysis of information sharing in T3, particularly the movement of casualty figures and the 
flow of information about the mechanisms used by the terrorists to disperse the contaminating 
agents, suggest a number of contributing factors to the difficulties observed, including: 

• proliferation of stovepiped electronic information systems; 

• vast number of nodes in the response network; 

• lack of formal information flow processes and the use of alternative channels; and 

• lack of uniform reporting guidelines and established procedures for validating 
information to build shared situational awareness and a COP. 

/. Proliferation of Stovepiped Electronic Information Systems 

The purpose of an electronic information system is to facilitate the exchange of information 
among a select group of individuals. In T3, the audience for different information systems ranged 
from the very narrow — a single agency — to the very broad — multiple operating centers staffed 
by different agencies and physically located in three separate countries. 

During the exercise, participants were observed using a number of different information systems. 
In some cases, the participants used secure intranets. In others, they used public websites to share 
information. T3 responders in New Jersey, Connecticut, at the interagency level, and in Canada 
and the United Kingdom used the following patchwork of information systems to disseminate 
time-critical information, pass requests for support, task issues, respond to requests for 
information, and log events: 

• Communicable Disease Reporting System (CDRS) . CDRS is an interactive web-based 
information management application that tracks communicable disease data. With these 
data, public health officials can generate reports and monitor trends in the spread of a 
disease. Plague patient data was entered into the NJ CDRS throughout the exercise.'^^ 

• E-Team . E-Team is a commercial off-the-shelf (COTS) crisis management application 
that provides personnel with the ability to exchange information, manage resources, track 


See htlp;//sph. umdnj.edu/campus/Dviriglio. pdf 
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requests, log events, and monitor deployments.^® During T3, the New Jersey State EOC 
relied on E-Team to support its response to the T3 scenario, whereas HHS used it to 
support its internal information management. 

• Health Operations Tracking System (HOTS) . HOTS is an application used to document 
health-related incidents in New Jersey.'^' During T3, New Jersey State and county health 
officials used HOTS to exchange information about the spread of plague and the State’s 
response to the emergency. For example, the Health Command Center used HOTS to log 
significant events as they occurred. County officials used HOTS to request medical 
resources through their county OEM. 

• Homeland Security Information Network (HSIN) International - HSIN International is a 
secure website that allows DHS representatives in U.S. embassies to exchange 
information with the HSOC via event logs, SITREPs, and chat sessions. During T3, it 
connected DHS representatives in the United Kingdom and Canada with Federal 
operations and information in the HSOC. 

• Information Control System (ICON) . ICON is a Microsoft© Access-based software 
program used internally by the FBI to run large-scale investigations. It allows for Bureau- 
wide communications to manage and share information about a specific investigation, 
including leads and results. During T3, the FBI used ICON to set leads and monitor the 
status of the investigation. 

• JFO Net . JFO net is the intranet developed and implemented by DHS to support 
emergency management activities and information flow across Federal operations 
centers, including the JFO, PFO cell. HSOC. and IIMG. During T3, JFO net was used to 
post tactical information from the Unified Command in Connecticut as well as more 
operational and strategic information from the JFOs and the HSOC in Washington, DC. 

• Law Enforcement Online (LEO) . LEO is a secure information system maintained by the 
FBI that provides a communication link for all levels of law enforcement in the United 
States. Through LEO, authorized users can access a variety of information tools, 
including an electronic law enforcement library, e-mail, chat, topical web pages, and 
areas for special interest groups.*^ During T3, the law enforcement community used LEO 
to document their activities and share information regarding the ongoing investigations in 
New Jersey, Connecticut, and internationally. 

• New Jersey Local Information Network and Communications System (NJLINCS) . 
NJLINCS is a system of public health professionals and electronic public health 
information that enhances the identification and containment of diseases and hazardous 
conditions that threaten the public’s health. Built on personal computer and Internet 
technologies, LINCS is a network of 22 strategically positioned local health departments 
located throughout the State, the New Jersey Department of Health and Senior Services, 


See http://www.eteam.com 
See https;//www. hots-nj.gov/ 

See http://www.fbi.gov/hq/cJisd/leo.htm 
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all other local health departments, and public/private organizations working at the 
community level to protect the public’s health.^^ 

The following list is not exhaustive, but represents the large number of information systems in 
use during the exercise, as well as how different response communities relied upon their own 
systems: 

• The State health community used HOTS, NJLINCS, ETEAM, HERMIS, and CDRS to 
coordinate a response to the spread of plague in New Jersey. 

• The State emergency response community in New Jersey used E-Team. 

• The Federal emergency response community used JFO net and HSIN International. 

• The law enforcement community used LEO and ICON. 

For the most part, these information systems used by different communities and levels of 
government have evolved independently. The result is a series of stovepiped systems that 
compartmentalize information. For example, in New Jersey, the State EOC was often unaware, 
or belatedly informed, of decisions made in the Department of Health and Senior Services 
(DHSS) Health Command Center (HCC) that were broadcast across HOTS but not 
communicated via other means until later. In another example, although the law enforcement 
community in both States was well informed via LEO of the status of the FBI’s investigation, the 
same cannot be said for members of the medical community or the Federal response apparatus, 
who had limited or no access to the FBI’s information system. This may have contributed to the 
delay or failure to correct misconceptions about the presence of mustard in the Beechcraft Baron 
found in Maine. Whereas other operating centers and agencies made decisions and developed 
plans under the incorrect belief that the aircraft was a red herring, persons with access to LEO 
could track the FBI’s inve.stigation of phone numbers found on the aircraft, the four individuals 
who exited the aircraft shortly after its arrival in Maine, and the venting/dispersal equipment 
found onboard during the initial search. In other words, only agencies with access to LEO knew 
that the aircraft was still under investigation. 

The widespread use of information systems can also foster the misperception that information 
has been widely distributed. However, their use can actually result in persons who need access to 
the information not having it, and persons with access not knowing new information is available 
or not having the time to retrieve it. Additionally, because these systems are not interoperable, 
any inputs or updates retrieved from another system must be entered manually, thereby 
increasing dissemination time, the likelihood for error, and the potential that information may not 
be entered at all, particularly as responders get busier during a crisis. The result can be that 
different communities, agencies, or operating centers are using different information for planning 
and decision making. The lack of common casualty numbers and the difference in information 
about the role of the aircraft in the mustard attack are key examples of this. 


See hnp://www. slate. nj.us/health/lh/lincs/ 
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2. Vast Number of Nodes in the Response Network 

The vast number of nodes in the response apparatus complicated the information sharing 
problem in a variety of ways. First, it lakes a tremendous level of effort to keep all agencies and 
operating centers informed and up-to-date. Second, the more people who touch a piece of 
information, the greater the chance that that information will be changed in some way. 
Therefore, the large number of nodes in the respon.se network increases the likelihood that 
incorrect or time-late information will be passed along. Table IV-4 identifies the 220 operating 
centers that were part of the T3 FSE domestic response network. Managing information flow 
becomes even more complex when the roles of international operating centers are taken into 
account. In effect, the number and variety of operating centers, or nodes, defines the scope of the 
information sharing problem by establishing the requirements for confirmation of a COP across 
all the centers. 
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Table IV-4. Nodes in the T3 Emergency Response 



Connecticut 

New Jersey 

Interagency 


• Incident Command Post 

• Hospitals (96) 


• Unified Coininand Post 

• Hospitals (32) 

• Points of Dispensing (22) 




• New London HOC 

• Local EOCs (22) 


State 

• State HOC 

• Siaie EOC 


• Area IV Coordinator 

• DHSS HCC 



• DPH ECC 

• NJ Hospital Association 



• Governor’s Office 

• Governor’s Office 


Federal 

• JFO 

• PFO 

• JFO 

• PFO 

• HSC 

• HSOC IDHS) 


• JOC 

• JOC 

• IIMG IDHS) 


• JIC 

• JIC 

• NRCC IDHS) 


• RRCC 

• RRCC 

• TSOC(DHS) 


• SERT 

• SERT 

• IOC IDHS) 


• USCG 


• Nice IDHS) 

• USCG NRC IDHS) 

• SOC IHHS) 

• FDA EOC IHHS) 

• CDC DEOC IHHS) 

• HRSA IHHS) 

• USMS EOC IDOJ) 

• EPA EOC 

• NORTHCOM (DOD) 

• FBI SIOC 

• JTTF IFBI) 

• DOT CMC 

• FAA EOC 

• NCTC 

• OSHA EOC IDOL) 

• ARC HQ DOC 

• VA ROC 

• IMAAC/NARAC 


3. Lack of Formal Information Flow Processes and Use of Alternative Means for Passing 
Information 

The proliferation of information systems and the vast number of agencies and operating centers 
involved in an emergency response expand the means or channels through which information 
can be shared. 

At the field level, incident radio communications procedures could have been improved. First 
responders spent a significant amount of time developing and de-conflicting an incident 
communication frequency plan. 
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Like much of the information relative to the situations in New Jersey and Connecticut, details 
about victim numbers initiated at a very local level — the incident site and hospitals in 
Connecticut, and hospitals and county medical examiners in New Jersey. In both cases, data on 
casualties moved from the local level to one or more State agencies, and then into the emergency 
response network of operating centers and State and Federal agency representatives. Figure IV-3 
shows the expected process for moving victim data on fatalities in New Jersey. Figure IV -4 
shows the same process for moving casualty data in Connecticut. The arrows at the top of the 
figures indicate that the expected flow of movement is left to right, from the local level to the 
Federal response organizations. The expectation would be an increased time delay in accurate 
casualty reports the further to the right an agency or operating center appears on the chart. 


Figure IV-3. Expected Information Flow for New Jersey Casualty Data 
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Figure IV-4. Expected Information Flow for Connecticut Casualty Data 



Although Figures IV-3 and IV-4 show the expected information flow processes regarding 
casualty numbers, the data from the exercise suggest a less organized process. Figure IV-5 shows 
an example of the information flow, as it occurred in Connecticut. 
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Figure IV-5. Actual Information Flow for Connecticut Casualty Data 



With the dashed lines. Figure IV-5 shows some of the secondary, or additional, means by which 
information moved among the responding agencies. Representatives from State and Federal 
agencies located at the Unified Command Post, the Slate EOC, and the JFO pushed casualty data 
(as well as other information) through their internal agency processes. Local, State, and Federal 
agencies within the same responder community shared information. For example, medical/public 
health information was shared among the New London Public Health Office, the Connecticut 
Department of Public Health, and HHS; information relative to the environmental community 
was shared among the Connecticut Department of Environmental ftotection, the EPA, and the 
US Coast Guard. Casualty data was shared via conference calls (e.g., between the governor and 
the PFO). Not shown in this chart, but also a source for information sharing, was VNN, 
representing all media, which often served to inform agencies and operating centers of new or 
updated information such as casualty figures. All of these means of information flow are logical, 
but in the end they often complicate a picture rather than cltirify it due to the potential for circular 
reporting and uncertainty over the authoritativeness of sources and the timeliness of the data.*’'* 


54 


For additional discussions of alternate information flow processes and examples from T.^, refer to the chapters on 
Emergency Operations under a Unified Command and Agent Confirmation and Hazard Area Definition. 
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D. Lack of Uniform Reporting Guidelines and Established Procedures for Validating 
Information to Build a COP 

During the T3 FSE, the ill-defined and inconsistent use of language, coupled with the use and 
forwarding of information from secondary or tertiary sources, led to a limited shared situational 
awareness across the Federal, State, and local response network. 

1. Ill-Defined and Inconsistent Use of Language 

The primary reason for the disparity in reported casualties in Connecticut was the use of many 
different terms to describe the status of victims. The ground truth .scenario divided the patients 
into pools of hospitalized, worried well, and fatalities. A review of the many different situation 
reports or updates that provided victim numbers in Connecticut revealed players used at least 
twelve separate descriptors: 

• missing; 

• casualties; 

• deceased/dead; 

• worried well; 

• walking wounded; 

• injured; 

• patients; 

• sick; 

• treated/released; 

• hospitalized; 

• awaiting hospitalization; and 

• symptomatic, but not hospitalized. 

Definitions of the descriptors were not provided, and exercise participants and operating centers 
used many of them interchangeably. For example, at 13;00 on April 5, the representative from 
the HHS SERT at the Connecticut Department of Public Health’s Emergency Command Center 
(CT DPH ECC) reported to his counterpart at the JFO that 6,000 persons had been hospitalized 
as of 12;30 that afternoon. Ten minutes after that update, at 13; 10. the CT DPH representative at 
the SEOC briefed that 1,632 persons had been admitted to hospitals, and 5,000 were awaiting 
hospitalization. This is Just one example of how two people from the same facility have different 
numbers as well as different descriptions of how those numbers break out. The result is different 
information originating from the same source. The effects of differences in how numbers are 
reported became noticeable by noon on April 6. when some individuals and operating centers 
appeared to begin differentiating between hospitalized, symptomatic but not hospitalized, sick, 
and “treated and released.” The result was significantly lower numbers of hospitalized patients 
reported than the ground truth provided. The use of unclear terminology by persons passing 
information to other operating centers resulted in a very different picture of casualty numbers 
and the State’s associated medical needs. At issue here is not which term best described the 
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medical status of victims in Connecticut, but rather the fact that all operating centers and 
agencies were using different descriptors. 

The varying use of language to characterize casualties was also a problem in New Jersey, though 
it did not show up in the fatality data. In that State’s re.sponse to plague, the terminology problem 
revolved largely around case definitions, and different criteria for counting plague victims. 
During the first day of the exercise, the CDC and State of New Jersey had different definitions 
for a probable plague case. It also appeared that the CDC was reporting confirmed case numbers, 
while New Jersey was reporting confirmed and probable cases. Data also show evidence of 
sources reporting different numbers for hospitalized victims versus those sick but not 
hospitalized. Once again, this contradicts the ground truth scenario, which simply divided the 
patients into pools of sick and dead. 

2. Use and Forwarding of Information from Secondary or Tertiary Sources 

The use and forwarding of information from other than primary sources was a particular problem 
during the T3 FSE. As is indicated by Figure IV-5, information flow from the local to the 
Federal level always involves secondary sources, or agencies and operating centers that receive 
information and pass it along through the response network. Problems arise when authoritative 
information is lost in all the traffic, or when documents labeled as formal and authoritative use 
information provided by secondary or tertiary sources. 

An example of the use of secondary sources and how they can complicate the operational picture 
is the dissemination of information associated with the aircraft used by the terrorists in 
Connecticut. Long after the FBI received confirmation that the aircraft tested positive for 
mustard, other agencies were still reporting time-late, incorrect information. Particularly 
noteworthy is that the reports by TSA and OSHA were included in the Connecticut PFO’s 
SITREP to the DHS Secretary with contradictory information from the authoritative source. That 
15:00 SITREP reports that: 

• per TSA, the FBI analysis of the 55-gallon tank aboard the aircraft yielded no trace of 
mustard, but rather contained residue of ammonium nitrates; and 

• per the FBI, the two drums found on the aircraft tested positive for sulfur mustard and 
additional samples analyzed by Edgewood also tested positive. 

As a formal document from the PFO to the Secretary informing him of the status of the situation 
in Connecticut, the SITREP should not contain secondary information, particularly when the 
authoritative source is nearby and available. It is unclear why the PFO and JFO Coordination 
Group continued to be uncertain of the means of dispersal through the conclusion of the FSE, 
considering the FBI Senior Agent in Charge (SAC), a member of the coordination group, should 
have served as the authority on the subject, immediately correcting any misperceptions about the 
source of the contamination. The contradictory information in the 15:00 SITREP offers an 
example of questionable consolidation and validation of secondary information. 
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The use of questionable sources and the issue of who is responsible for validating information 
also influenced the differences in casualty figures observed during the T3 FSE. Particularly at the 
Federal levels, variation in numbers appeared to be a result of who was providing the data and 
where in the operating center it was routed. For example, in the Connecticut JFO, both the 
Situation Unit in the Planning Section and the HHS representative to the JFO Coordination 
Group were tracking victim numbers, but were reporting different results. Initially, the Situation 
Unit was getting its data from a variety of different sources, including the FBI, the Unified 
Command, and the State HOC. ESF #8 and the HHS Senior Federal Official (SFO) received 
updates from the SERT and from the Connecticut DPH. At the same time, the PFO cell and JFO 
Coordination Group were receiving casualty updates via conference calls with the State EOC and 
the Unified Command. Frustrated with the different victim numbers, the JFO Coordination 
Group sought to correct the problem by tasking the HHS SFO to clarify the casualty situation at 
12:20 on April 5. Although that resolved the issue in the short term, it did not fix the underlying 
process problem, which was that multiple groups and teams in the JFO were requesting and 
receiving casualty data from various sources. The issue arose again the next day at 13:15, when 
the JFO Planning Section discussed the most current numbers received from ESF #8. the Unified 
Command, the State EOC, and the PFO. all of which varied. Recognizing the need for a more 
permanent solution to the problem of contradictory figures, the Planning Section Chief 
determined that the SEOC would be the single, authoritative source for updating the JFO’s 
casualty data. This example indicates that exercise participants recognized the need for 
identifying authoritative sources. 

3. Inadequately ‘‘Shared’’ Situational Awareness across Operating Centers 

During the T3 FSE, agencies and operating centers were often making decisions and acting on 
different information. In Connecticut, the Unified Command drafted its initial air and ground 
sampling plan under the misconception that the truck bomb was the means by which the mustard 
was dispersed. Top Federal officials responding to the plague crisis in New Jersey had different 
casualty figures than State and Federal operating centers. These different figures drove the 
decision to open more PODs than State public health officials initially recommended. 

Both of the previous examples originated from errors by exercise controllers. However, it should 
not matter where bad information originates or how it enters the system; it still needs to be 
corrected. For example, on September II, 2001, televi.sion news stations reported disturbances 
on the National Mall in Washington. DC, which were later proven to be false. More recently, 
initial reports out of London contended that the July 7, attacks were not the work of suicide 
bombers, information that later proved to be incorrect. Law enforcement officials immediately 
proceeded to correct the error. Whether incorrect information is from an exercise artificiality, a 
product of premature reporting, or a result of the chaos of a situation, there need to be methods 
and means for correcting or updating the information. 

Overall, the examples from the T3 FSE indicate failures to adequately validate and consolidate 
information at all levels of the response. Situational awareness was not effectively shared, nor a 
COP developed, across responding operating centers and agencies. 
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At the Federal level, the NRP tasks the HSOC with developing the COP and maintaining 
situational awareness of the incident and the response. To this end, the HSOC SOP provides 
specific guidelines for the COP display. The HSOC’s COP is an electronic display of a map of 
the United States embedded with nodes of the national infrastructure. The map contains a variety 
of icons that allow users to drill down to threat information, SITREPs, and spot reports. The 
COP is available to operating centers outside the HSOC via JFO Net. 

Observations during T3 FSE indicate that the COP described in the HSOC SOP does not 
adequately support emergency situational awareness across the Federal operating centers. This is 
evidenced by examples of HSOC desk officers searching through e-mails and querying other 
desk officers for status of EEls. The COP did not lend itself to displaying such information 
because it is largely just a graphical user interface, through which users can post and access 
situational reports or intelligence provided by other operating centers or agencies. This approach 
to a COP may be sufficient for daily operations, when the HSOC is monitoring threats or 
potential threats, but during an emergency response, information is more fluid and the EEls 
themselves are different. The HSOC SOP focuses on the picture itself, not the EEls that need to 
be tracked. Moreover, not all EEls can be displayed visually, but they still need to be tracked and 
shared. As a result, the COP itself became useless. 

Additionally, the HSOC SOP does not establish the processes needed to maintain and share the 
EEls, including the mechanisms necessary for consolidating and validating information. EEls to 
be shared between operating centers and agencies were never clearly defined. During the T3 
FSE, the primary means of sharing information among the responding Federal agencies was 
forwarding e-mails to all the representatives in the HSOC. Each individual was then responsible 
for developing and maintaining their own knowledge of the state of the incident, to include 
filtering and consolidating information for movement outside the HSOC itself. This process, or 
lack thereof, also meant there were no opportunities for group sharing, to support validation or 
conflict resolution. Finally, no process existed and no effort was made to insure that everyone in 
the HSOC had common knowledge. 

E. Issues from Previous Exercises 

The T2 AAR identified two overarching information flow issues: 

• lack of formal processes/channels (or understanding of them) for official information and 
lack of consistent understanding of formal, validated sources for information; and 

• use of inconsistent or technical language. 

It is clear from the T3 FSE that these issues remain a significant challenge in an emergency 
response operation. 

The prevailing communications issue during the T2 FSE was the lack of formal processes or 
channels for official information and the prevalence of informal processes, all of which led to 
difficulties validating information. The T3 observations indicate that although some formal 
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processes have been instituted, namely the PFO-HSOC-IIMG connection, the informal and 
internal agency processes continue to complicate the flow of valid information. 

The use of inconsistent language proved to be another communications challenge during T2, 
specifically the interchangeable use of the term “casualties.” The T3 FSE revealed continued 
problems with inconsistent and ill-defined terminology. 

Inaccurate reports of casualty figures were also a considerable problem during the T2 FSE play 
in Illinois, where a plague attack was simulated. Analysis attributed the problems to the complex 
and multiple ways in which patient data were communicated {e.g.. fax, landlines, and cell 
phones), variation in the descriptors used with the data, and exercise artificialities associated 
with additional, unscripted injects by an organization outside the T2 planning team and scripted 
or pretaped media play. The experience in T3 did not suggest any improvement in the accurate 
and timely reporting of casualty figures. In particular, problems with language, namely 
inaccurate and inconsistent use of descriptors, were still a significant problem in the T3 FSE. 

The T3 CPX revealed little evidence of consolidated information flowing from the HSOC to the 
other Federal agencies. Additionally, no specific information requirements, or EEls were 
developed for the exercise, nor was there a shared COP. These issues continued to be 
problematic during T3 FSE. 
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Table IV-5. Comparison of T3 FSE with Previous Exercises 


T2 FSE 

SOEs 

T3 FSE 

ISSUES/OBSERVADONS 




• Lack of consistent understanding of 
formal, validated sources for 
information. 

• Inconsistent use of terms/unclear 
technical language. 


w 

• Lack of uniform reporting guidelines 
and procedures for validating 
information received from 
secondary or tertiary sources. 




• Too many official reporting channels. 

• In some cases, lack of formal 
processes/channels for official 
information. 

• Various agencies had their own, 
Independent procedures and 
redundantly requested updates 

• Hospital data was largely paper>based 
and disparate reporting processes were 
burdensome. 

• Lack of a robust system for 
sustained coordination with FSL 
governments and private sector 
partners — especially how to 
reduce, and not add to, the 
"white noise” or "fog of war" 
anticipated In preattack threat 
stages. 

w 

• The use of informal or alternate 
channels for sharing Information 
caused problems by enabling 
circular reporting and bypassing 
authoritative sources. 


• Participants discussed the large 
number of operations centers 
and coordinating entities that 
are Involved in a response to a 
terrorist Incident. 

• The vast number of operating 
centers negatively affected 

Information sharing by increasing 
the scope and complexity of the 
problem. 

• Agencies and operating centers 
acted and made decisions on 
different Information. 


• Officials questioned how 
effectively the large number of 
operations centers and 
coordinating entitles would 
share information and the 
degree to which they would 
share a "common" picture of 
the incident. 

• Agencies and operating centers 
made decisions and acted on 
different information. 

• Situational awareness was not 
effectively shared across operating 
centers and agencies. 


• Concern that information that is 
shared is not being transmitted 

In formats or with needed tear 
lines so that some agencies can 
use It. 

• What influence (If any) that 
concern about potential media 
leaks should have on the 
release timing and content of 
unclassified intelligence 
bulletins (and tear lines). 



• Concern regarding the sharing 
of information between the 
incident site, JOC, JFO, and 

State EOCs. 

• 
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F. Conclusions 

Accurate and timely sharing of information and the resulting development of a COP are critical 
for the success of an integrated Federal, State, and local response. Experiences during the T3 
FSE indicate that these issue.s remain problematic for the operating centers and agencies 
involved in a domestic response. 

The information systems used in T3 were largely stovepiped within agencies and/or response 
communities. Instead of facilitating exchanges, these systems contributed to the 
coinpartmentalization of information and a misperception that information was widely 
disseminated. The entire domestic response community should be working toward 
interoperability and integration of systems. The Homeland Security Information Network 
initiative is likely a good starting point, as it works to link at least some of the Federal response 
operating centers (e.g., JFO, HSOC, and IIMG) and the law enforcement community. 

The vast number of operating centers activated to support the emergency response during T3 
negatively affected information sharing by increasing the scope and complexity of the problem. 
The more operating centers and/or agencies involved in the response, the greater the number of 
operating pictures that need to be aligned with the COP, the more channels are available through 
which information can pass, and the greater the number of opportunities for errors or changes to 
be made in the information. Each Federal agency should assess its emergency response 
operations and consider reducing the number of operating centers activated, consolidating them, 
or collocating personnel to facilitate better communication during an Incident of National 
Significance. 

During T3, participants made use of informal or alternate processes to move information 
throughout the response network. This complicated information sharing and the development of 
a COP by enabling circular reporting and increasing uncertainty over the authoritativeness of 
information sources. 

Ill-defined and inconsistent use of language and the extensive use of information from secondary 
and tertiary sources indicate a lack of uniform reporting guidelines and procedures for validating 
information. To preempt inconsistent use of language, the different response communities should 
identify key terms that are likely to appear during a WMD response, standardize their definitions, 
and then disseminate the information across the entire response network. Much of this work can 
be done in advance of any incidents. However, some definitions may need to be revised or 
developed during an emergency response. For example, during the outbreak of Severe Acute 
Respiratory Syndrome (SARS) in 2003, the CDC and other health agencies around the world 
developed and revised case definitions throughout the crisis. Therefore, response communities 
also need to identify mechanisms to update and disseminate definitions during response 
operations. 

Stovepiped systems, the vastness of the response network, the existence of alternate information 
flow channels, and the lack of uniform reporting guidelines and validation procedures resulted in 
situational awareness not being effectively shared, nor a COP developed across responding 
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Operating centers and agencies. Instead, agencies and operating centers made decisions and acted 
on different information. To build shared situational awareness, the response network needs to: 

1 . Identify and define the overlapping critical information required by all the responding 
communities, 

2. Establish specific reporting protocols and guidelines for all levels of government. 

3. Identify the authoritative sources for EEIs. 

4. Identify an operating center at each level of the response to act as “keeper of the 
COP. 

5. Develop protocols for horizontal and vertical coordination (i.e., horizontally across 
one level of government and vertically between levels) to align the operational 
pictures developed and maintained by different operating centers and agencies. 

/. Recommended Courses of Action 

• Support the development of interoperable information systems and/or a suite of 
emergency response/management applications that can be used across response 
communities. 

• Consider development of a DHS field operations guide that lists radio 
frequencies/preferences of Federal, State, and local responders to expedite the 
development of communications plans. 

• Assess the roles and responsibilities of each emergency response operations center 
and consider reducing the number of operating centers, consolidating them, or 
collocating personnel. 

• Require that all casualty numbers reported are attached to a clear description of the 
information included in the report. 

• Identify key terms that are likely to appear during a WMD response, standardize their 
definitions, and then disseminate the information across the entire response network. 

• Establish mechanisms to update and di.sseminate new definitions during response 
operations. 

To build an accurate and effective common operating picture, the response network needs to: 

1. Identify and define the overlapping critical information required by all the responding 
communities. 

2. Establish specific reporting protocols and guidelines for all levels of government. 

3. Identify the authoritative sources for EEIs and what EEIs should be communicated. 

4. Identify an operating center at each level of the response to act as “keeper of the 
critical information.” 

Develop protocols for horizontal and vertical coordination (i.e., horizontally across 
one level of government and vertically between levels) to align the operational 
pictures developed and maintained by different operating centers and agencies. 
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Part 5: Analysis of Critical Task Performance 


The number of participants in TOPOFF 3 (T3) makes it impossible to evaluate the critical 
tasks of every player and organization. Hotwashes and an After-Action Conference 
allowed players to discuss the exercise and their perceived participation and performance 
within the exerci.se. They also gave the evaluation team a chance to focus the topics that 
would be discussed in this document. The fact that an issue was not selected for analysis 
does not signify that it is not a critical task in our national Homeland Defense Strategy. 
Rather, the six items offer a cross-section of the complex nature of the exercise and the 
various lessons learned. As stated earlier in this report, the items to be discussed in this 
section are: 


Critical 

Tasks 


• Stafford Act Declarations 

• Emergency Public Information 

• Integrating Responses to Incidents of National Significance: Public 
Health Emergency and the Stafford Act 

• Strategic National Stockpile and Points of Dispensing 

• Agent Confirmation and Hazard Area Definition 

• Emergency Response Operations under a Unified Command 


This section of the report reviews performance of critical tasks as identified by the 
HSEEP Volume II Exercise Evaluation Guide (EEC). Each critical task was chosen 
because of the significant effect that the.se issues had on the exercise participants and the 
exercise as a whole. 

Some topics overlap, but each account is written so that it may stand on its own. The 
format for discussion of each critical task is provided in accordance with HSEEP Volume 
II EEG guidance. Accounts begin with a brief introduction to the issue and related EEG 
task and number, followed by a summary of observations. The summary contains a 
background discussion of any relevant policies, doctrine, or procedures. This is followed 
by a reconstruction of key events from the exercise. The analysis section presents the 
issues that emerged in the exercise, including detailed examples and potential 
explanations for the behavior or result. The analysis is followed by a comparison of the 
T3 Full-Scale Exercise (FSE) results with any relevant conclusions from previous 
exercises. Finally, each account concludes with a review of recommended courses of 
action. 
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I. Stafford Act Declarations — Task # 111-10: Request State/Federal 
Assistance 

A. Summary of Issue 

The issue is whether an incident with a non-explosive biological, chemical, or 
radiological weapon would fit the definition of a major disaster under the Stafford Act. 
During the T3 FSE, there were several declarations and proclamations of emergencies 
and disasters. State and local jurisdictions in both exercise venues invoked their 
authorities to declare emergencies and also requested Federal assistance under the 
Stafford Act. These requests ultimately led to presidential declarations of major disaster 
in Connecticut and of emergency in New Jersey. 

In this exercise, just as in the T2 FSE, participants discussed the applicability of a 
Stafford Act major disaster declaration to terrorist attacks, especially to attacks that 
feature non-explosive biological weapons. Although the Governor of New Jersey 
requested a major disaster declaration, an emergency declaration was provided. Under an 
emergency declaration, there are limitations in the types and amount of assistance that 
can be provided. The effects of these limitations were not fully explored in the T3 FSE. 
However, in the T3 Large-Scale Game (LSG), uses of the existing Stafford Act and other 
Federal programs were identified to make up for the shortfalls in assistance that New 
Jersey experienced under the emergency declaration. Throughout the exercise, it has been 
acknowledged that the Stafford Act needs amending to include all hazards, including 
terrorist acts. 

R. Background 

Federal declarations made under the Stafford Act generally start with a request from a 
State Governor.' Requests for declarations of both emergency and major disaster must 
“be based on a finding that the disaster is of such severity and magnitude that effective 
response is beyond the capabilities of the state and the affected local governments and 
that Federal assistance is necessary.”^ The Stafford Act defines a major disaster as: 

any natural catastrophe (including any hurricane, tornado, storm, 
high water, wind driven water, tidal wave, tsunami, earthquake, 
volcanic eruption, landslide, mudslide, snowstorm, or drought }. or 
regardless of cause, any fire, flood, or explosion, in any part of the 
United States, which in the determination of the President causes 
damage of sufficient severity and magnitude to warrant major 
disaster assistance under this chapter to supplement the efforts and 
available resources of states, local governments, and disaster 


' In T3. the President declared an emergency in New Jersey before application was made. 

^ The Robert T. Stafford Disaster Relief and Emergency Assistance Act, As Amended, 42 U.S. Code 
(U.S.C.) 5121, et seq., http://www.fema.gov/library/staf act..shtm. 
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relief organizations in alleviating the damage, loss, hardship, or 
suffering caused thereby. 

Under a presidential declaration of major disaster. States may be reimbursed for up to 
100% of qualifying expenses. 

An emergency is defined as: 

any occasion or instance for which, in the determination of the 
President, federal assistance is needed to supplement state and 
local efforts and capabilities to save lives and to protect property 
and public health and safety, or to lessen or avert the threat of a 
catastrophe in any part of the United States. 

Federal assistance under a presidential declaration of emergency is limited to $5 million 
for a single emergency except in circumstances in which the President determines that: 

• Continued emergency assistance is immediately required; 

• There is a continuing and immediate risk to lives, property, public health, or 
safety; and 

• Necessary assistance will not otherwise be provided on a timely basis.^ 

Differences between a major disaster declaration and an emergency declaration include 
limitations in public assistance, individual assistance, and hazard mitigation. Table 1-1 
summarizes the differences in Federal assistance under a major disaster declaration and 
an emergency declaration.'* Exceptions may be made if the President determines that 
additional assistance is nece,ssary to “to save lives, protect property and public health and 
safety, and lessen or avert the threat of a catastrophe.” 

Table I-l. Types of Federal Assistance for a Major Disaster and an Emergency 


Type of Assistance 

Major Disaster 

Emergency 

Public Assistance 



Catcsorv A: Debris removal 

X 

X 

Category B : Emergency protective 
measures 

X 

X 

Category C: Road systems and bridges 

X 


Category D: Water control facilities 

X 


Category E: Public buildings and contents 

X 


Category F: Public utilities 

X 


Category G: Parks, recreational, and other 

X 



’ Section 503 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as Amended, 42 
U.S.C. 5121. 

* Based on comparison sheet faxed to New Jersey State EOC from DHS Emergency Preparedness and 
Response on April 8, 2005. 
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Type of Assistance 

Major Disaster 

Emergency 

Individual Assistance 



Housing assistance 

X 

X 

Other needs assistance (e.g., medical, 
funeral) 

X 

1 

1 X 

Disaster unemployment assistance 

X 


Legal services 

X 


Food coupons and distribution 

X 


Crisis counseling 

X 


Hazard Mitigation 

X 

1 


C. Reconstruction 

At 12:14 on April 4, 2005, the Governor of New Jersey declared a state of emergency, 
initiated the activation of the State Emergency Operations Center (EOC), and raised the 
State’s threat condition level to Orange after the presumptive diagnosis of pneumonic 
plague and the discovery of a suspected dispersal mechanism. At 14:12, the Governor of 
Connecticut responded to the explosion at the New London City Pier by declaring a state 
of emergency, activating the State EOC. and raising the State’s threat condition level to 
Orange. 

The Secretary of Homeland Security declared the events in New Jersey to be an incident 
of national significance (INS) at 14:00 and designated a Principal Federal Official (PFO). 
Later at 16:()0, the Secretary declared the events in Connecticut to be an INS and 
designated a PFO, 

The Governor of Connecticut verbally requested a declaration under the Stafford Act 
from the President at 15:00. This was followed by a faxed written request. At 16:30, the 
National Response Coordination Center (NRCC), Interagency Incident Management 
Group (IIMG), Regional Response Coordination Centers (RRCCs), and other operations 
centers reported that the President had verbally declared emergencies for Connecticut and 
New Jersey under the Stafford Act. Later, the declaration in Connecticut was corrected to 
a major disaster. The major disaster declaration covered public assistance Category A 
(debris removal) and Category B (emergency protective measures). Individual assistance 
was initially not included in this declaration, even though it was included in the 
Governor’s request. Individual as.sistance later was approved. 

New Jersey faxed a formal request for an emergency declaration under the Stafford Act 
to the Region 2 RRCC at 16:59. In New Jersey, the emergency declaration provided 
public assistance for Union and Middlesex Counties. On April 6, the emergency 
declaration was amended to include 10 additional counties: Bergen, Burlington, Essex, 
Hudson, Mercer, Monmouth, Morris, Passaic, Somerset, and Sussex Counties. On April 
7. the Federal Emergency Management Agency (FEMA) added the remaining nine 
counties in New Jersey to the emergency declaration and designated residents of all 
counties eligible to receive individual assistance. Because individual assistance was 
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approved for New Jersey, the Small Business Administration was able to provide disaster 
loan assistance. New Jersey requested 2,000 crisis counselors/mental health 
professionals. On April 8, FEMA denied New Jersey’s request, because New Jersey had 
received an emergency declaration instead of a major disaster declaration. Although the 
Governor of New Jersey had attempted to have the emergency declaration converted to a 
major disaster under the Stafford Act, the exercise ended before the Governor’s request 
was addressed. 

D. Consequence 

Both of the simulated terrorist attacks in the T3 FSE led to presidential declarations under 
the Stafford Act. 

The Stafford Act does not explicitly include events involving non-explosive radiological, 
chemical, or biological weapons in its definition of major disasters. However, some 
participants indicated that the Stafford Act may be interpreted to include such incidents 
under its definition of major disasters. Clarifying this point would reduce debate and 
confusion during a time of crisis. If these types of incidents are not covered under a major 
disaster declaration, Congress should consider adding them to the definition. 

If it is determined that biological, chemical, or radiological incidents do not fit the 
definition of a major disaster, subgranting under Stafford Act declarations may provide 
additional types of Federal assistance. However, this would require the emergency to be 
linked to another incident involving an active major disaster declaration. Other Federal 
assistance programs not connected to the Stafford Act may be able to provide additional 
assistance. Federal agencies should develop a list of what assistance programs may apply 
and under what circumstances they would apply. 

Most likely, Federal assistance to the victims of an attack with a non-explosive 
biological, chemical, or radiological weapon would exceed the $5 million limit of an 
emergency. In the past. Congress has granted exceptions to this limit under such 
circumstances. Therefore, this monetary limit is unlikely to result in significant impacts 
on response spending. 

E. Analysis 

Under the Stafford Act. a major disaster declaration would provide more types and a 
greater amount of assistance than an emergency declaration. In T3. the primary issue with 
Stafford Act declarations was the applicability of a major disaster declaration to a 
biological incident. Because New Jersey received an emergency declaration instead of a 
major disaster declaration and the additional assistance that comes with a major disaster. 
Federal agencies worked to provide assistance that was not covered by the Stafford Act 
Declaration. By the end of the FSE the SBA had provided assistance to New Jersey. 
Additionally, the use of verbal approvals for the initial declarations without supporting 
documentation and formal requests caused uncertainty as to what type of declarations 
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were approved and what types of assistance should be provided. Analysis of T3 revealed 
that: 

• It is unclear whether a major di.sa.ster declaration under the Stafford Act can 
be applied to a biological incident. 

• Subgranting under the Stafford Act and other Federal programs may provide 
for some shortfalls in types of as.sistance provided under an emergency 
declaration. 

• Because of exception clauses in the Stafford Act, limitations in the amount of 
monetary a.ssistance under an emergency declaration would probably not 
result in any substantive real-world impact. 

• Verbal declaration approvals and a lack of written requests led the NRCC, 
both RRCCs, and both State EOCs to be uncertain as to what type of 
declaration was approved and what types of assistance were granted. 

/. Uncertainty about Applicability of a Major Disaster Declaration to Biological 
Incidents 

The incidents in New Jersey were not addressed by a major disaster declaration under the 
Stafford Act because the circumstances of a biological attack are not explicitly included 
in the definition of a major disaster. In the initial request for a declaration, the Governor 
of New Jersey stated that he was aware that “under current application of these provisions 
(Stafford Act], the spread of an infectious, biologically based disea.se is not regarded as a 
major disaster.” He asked the President and Congress “to seek revision of the Stafford 
Act to ensure that appropriate assistance is available.” The Governor also requested crisis 
counseling, legal services, food stamps, and unemployment benefits assistance, which are 
not covered under an emergency declaration. Later, the Governor of New Jersey asked 
FEMA to convert the emergency declaration to a major disaster declaration, because the 
State sought some of the assistance available only under the latter declaration. New 
Jersey had submitted a specific request for crisis counseling, but did not receive it 
because crisis counseling is not covered under an emergency declaration. 

To clarify the application of a major disaster declaration, the most straightforward 
solution would be to amend the Stafford Act and update the disaster definition. However, 
some FEMA participants in the T3 FSE did not believe that amending the Stafford Act 
was necessary. Instead, they suggested that the language used in the Stafford Act to 
define a major disaster could be interpreted to include a significant biological attack.'^ 
However, they did not want to set a policy precedent in an exercise. 

Because of the differences in the types and amounts of assistance and because of the 
potential scale and scope of such an incident, it would be preferable to have a major 
disaster declaration apply to any incidents involving a weapon of mass destruction 
(WMD). Furthermore, the experiences from the T2 and T3 FSEs indicate that the 
definition of a major disaster declaration and the range of incidents to which it applies 


' These FEMA participants did not specify the details of the reinterpretation, but simply suggested it as a 
viable option. 
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need to be clarified to eliminate any uncertainty. It would be inappropriate and ineffective 
to debate these types of issues during an actual crisis. 

2. Alternatives for Shortfalls in Types of Assistance 

Because a major disaster declaration did not apply to incidents like the simulated 
biological attack in New Jersey. T3 participants identified alternative sources to 
compensate for the shortfalls in the emergency declaration. NJ residents were not eligible 
for some types of individual assistance that were available to residents in New London. 
Under the emergency declaration, NJ residents could not receive unemployment disaster 
assistance, legal services, tax considerations, or crisis counseling. The impact of these 
shortfalls would not have been felt in the timeframe of the T3 FSE and therefore were not 
played. However, they were discussed during the T3 LSG.^ 

At the T3 LSG, participants focused extensively on how to make up for a lack of 
assistance under an emergency declaration. The Human Services group had a lengthy 
discussion about how to provide crisis counseling and other services to NJ residents 
without statutory changes to Stafford Act language or supplemental appropriation from 
Congress. The propo.sed solution was “subgranting” through the major disaster 
declaration in Connecticut to provide mental health services in both States. 

The subgranting of crisis counseling for an emergency declaration through a major 
disaster declaration does have a limitation. Using a subgrant to provide crisis counseling 
requires an active major disaster declaration in a State with a linked situation. Although 
New Jersey was not one of the sites of the September 1 1, 2001 (9-11) terrorist incidents, 
a large portion of the NY workforce lives in the State, As a result, an emergency 
declaration was issued for the State, along with the major disaster declaration for New 
York. In T3, the terrorist attacks in Connecticut and New Jersey were conducted by 
related terrorist groups and during the same timeframe. T3 LSG participants believed that 
this was sufficient to link the incidents. Connecticut’s major disaster declaration fulfilled 
the requirement of an active major disaster declaration. 

Another potential method for augmenting the assistance limitations of an emergency 
declaration would be to provide funding for crisis counseling through other sources, such 
as the Substance Abuse and Mental Health Services Administration (SAMHSA) Office 
for Victims of Crimes (OVC). Other Federal programs also may address the shortfalls 
related to the types of assistance not provided under an emergency declaration. 

A major disaster declaration can provide more types of Federal assistance than an 
emergency declaration. These types of assistance may be needed by individuals and 
businesses that are victims of a significant biological attack. Subgrants under the Stafford 
Act, if applicable, and assistance from other Federal programs could compensate for the 


^ The T3 LSG was conducted from May 3-5, 2005, at the National Conference Center, Lansdowne, VA. 
The T3 LSG focused on recovery issues at 30 days, 90 days, and 1 80+ days after the T3 FSE scenario. 
Refer to the section on T3 building block events for more information on Ihe T3 LSG. 
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limited assistance provided by an emergency declaration. Another option is for Congress 
to appropriate additional funds to compensate for the limited assistance. 

3. Limitations in the Amount of Assistance 

Another difference between declarations of emergency and major disaster is the limit on 
the amount of funding. An emergency declaration has a $5 million limit on assistance. 
This limit can be exceeded if the President determines that it is required. As discussed 
above, the criteria for exceeding limits on Federal assistance are: a continued need for 
emergency assistance; an immediate risk to lives, property, public health, or safety; and 
assistance that will not otherwise be provided on a timely basis. The events in New Jersey 
would have met the criteria for exceeding the funding limits. To obtain additional 
funding, the President would have to “report to Congress on the nature and extent of the 
emergency assistance requirements” and “propose additional legislation if necessary.”’ 

The Governor of New Jersey stated in his request for an emergency declaration that 
preliminary “indications of costs are well in excess of $5 million.” Continued assistance 
would be required. With the exception of a FEMA Mission Assignment log, however, 
exercise data do not indicate that there was any further discussion of extending Federal 
assistance to New Jersey or any action taken to address supplemental authorizations. 

It is unclear how exceeding the funding limits would have affected response efforts in T3. 
In previous incidents. Congress granted additional assistance when requested. For 9-11, 
the President asked Congress to pass emergency appropriations to provide immediate 
resources for responding to the terrorist attacks.* By September 18. 2001, Congress had 
appropriated $3 billion in Federal assistance to New York City and followed up with 
additional appropriations as the scope of the disaster was revealed. The 9-1 1 experience 
suggests that the President would request additional assistance and that Congress would 
act quickly in response. Congress did not play in this exercise, and the exercise was too 
short to examine the actual impact of the spending limits of an emergency declaration. 

For an incident of the size and scope of that in New Jersey, the Federal government 
would have probably quickly exceeded the spending limits imposed under a Stafford Act 
emergency declaration. The Stafford Act provides for additional funding based on 
Congressional approval. However, the T3 FSE did not provide the opportunity to test that 
approach to funding. It is unclear how difficult or time consuming it would be to ask 
Congress for additional assistance, but real-world experience suggests that this approach 
would not have any substantive impacts on the Federal response. 


’ Section 503 of the Robert T. Stafford Disaster Relief and Emergency Assistance Act. As Amended, 42 
U.S.C. 5121. 

* GAO report, September 1 1. Overview of Federal Disaster Assistance to the New York City Area, October 
2003, Report number 04-72. 
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4. Initial Uncertainty about Declaration Type and Assistance 

The NRCC and RRCCs first heard about the emergency and major disaster declarations 
through the announcement of the President’s verbal approval of two emergency 
declarations. The NRCC did not receive the written request until 18:00 on April 4, 
approximately three hours after the announcement. During the hours between the 
announcement of the approval and receipt of the written request, representatives at the 
NRCC tried to locate the formal request and determine what type of declaration was 
approved and what types of assistance would be provided. 

The State EOCs, both RRCCs, and NRCC held conference calls to sort out what was 
approved. The verbal reports of approval for an emergency declaration for Connecticut 
conflicted with Connecticut’s reque.st for a major disaster declaration. Federal and State 
agencies were uncertain about what types of public assistance were approved and 
whether individual assistance had been requested. Although the resulting delay in 
requesting resources was not substantial, this incident highlights a source of uncertainty 
and is an example of an event in which the results of meetings held by decision makers 
were not relayed in sufficient detail for their staffs to execute. 

5. Issues from Previous Exercises 

In T2 FSE, a large-scale bioterrorism attack did not qualify as a major disaster. It was 
recommended that future efforts, including exercises, continue to refine the applicability 
of the Stafford Act to bioterrorism and other non-explosive disasters not explicitly 
defined by the Act, as well as continue to familiarize Federal, State, and local (FSL) 
agencies with applying the Act during such disasters (Table 1-2), 

The T3 Command Post Exercise (CPX) featured a unique application of the Stafford Act. 
The President signed a declaration of emergency for the area between Boston, MA, and 
Norfolk, VA. The declaration was based on an imminent threat rather than an actual 
incident. The exercise prompted department and agency participants to question the use 
of the Stafford Act as a tool for the Federal government to take preparatory measures in 
anticipation of a terrorist attack. 

In particular, the T3 CPX highlighted the need to clarify policy and guidance for 
deployment of emergency response assets and funding in anticipation of an imminent 
terrorist attack. In addition, the CPX suggested the need to examine the ramifications of 
pre-incident deployments if no incident occurs. 
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Table 1-2. Comparison of T3 FSE with Previous Exercises 


T2FSE 

T3CPX 

T3FSE 

SIGNIFICANT DECISIONS 

• The President declared e major disaster 
for Seattle as a result of the radiological 
dispersal device (ROD) attack. 

« Illinois requested a declaration of major 
disaster for Chicago and its surrounding 
counties as a result of the outbreak of 
pneumonic plague. The President 
declared an emergency for those 
locations to Include Individual 

Households Program and Categories A 
and B under Public Assistance. 

• Based on intelligence, the 
President signed a declaration 
of emergency for the area 
between Boston, MA and 

Norfolk, VA, in advance of an 
actual incident. 

• The President declared a major 
disaster in Connecticut as a result 
of the vehicle<bome improvised 
explosive device (VBIED) and 
chemical attacks. 

• New Jersey requested and received 
an emergency declaration for the 
two most affected counties, later 
amended twice to include the entire 
State as a result of the outbreak of 
pneumonic plague. 

• New Jersey requested that the 
emergency declaration be converted 
to a major disaster, but the exercise 
ended before the request was 
addressed. 

ISSUES/OBSERVATIONS 

« Despite Illinois' request for a disaster 
declaration, FEMA determined that “an 
emergency declaration is ... (the} most 
appropriate Immediate action.” 

• The outbreak of pneumonic plague did 
not qualify as a "major disaster " wHhIn 
the meaning of the Stafford Act. 

N/A 

• The Governor of New Jersey stated 
that he was aware that "under 
current application of these 
provisions (Stafford Act], the spread 
of an infectious, biologically based 
disease is not regarded as a major 
disaster." 

• FEMA applies a strictly literal 
interpretation of the Stafford Act. 
Because biological attacks are not 
explicitly Included In the definition 
of a major disaster, only emergency 
declarations can be applied. 

• Illinois officials were unaware that the S5 
million limit to assistance under an 
emergency declaration can be exceeded 
under certain conditions. 

N/A 

• No evidence of concern about the 
spending limitations in New Jersey 

• Concerns about the specific types 
of assistance available in an 
emergency declaration 

This problem was accentuated 
because Connecticut was receiving 
types of assistance not available to 

New Jersey as a result of the differeni 
declarations. 


• Participants questioned the use 
of the Stafford Act as a tool for 
the Federal government to take 
preparatory measures in 
anticipation of a terrorist attack. 
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F. Recommendations 

• Determine the applicability of a Stafford Act major disaster declaration to non- 
explosive incidents involving WMDs, particularly those involving a large-scale 
bioterrorism incident. 

• If these types of incidents do not fit the definition of a major disaster declaration, 
determine whether exemptions within the Stafford Act for Emergency 
Declarations and other Federal programs can result in an equivalent level of 
assistance and can be delivered with an equivalent level of expediency during an 
incident. If they can, ensure that States are aware of them. 

• If the Stafford Act major disaster declaration does not cover these types of 
incidents and if equivalent Federal assistance is not available through other 
means, pursue legislation to address this problem. 

• Until legislation is passed that would allow these types of incidents to receive the 
full range of Federal assi-stance provided under a major disaster declaration, 
identify other Federal programs that may be able to provide assistance and ensure 
that States are aware of them. 
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II, Emergency Public Information — Task # 111-14; Provide Emergency 
Public Information to Media and Public 

A. Summary of Issue 

The issue is that FSL agencies may still not be prepared to provide swift, accurate, and 
consistent lifesaving protective action guidance to the public. The term “emergency 
public information" reflects an understanding that public information during an 
emergency might differ from normal, day-to-day, public information provided to citizens 
by the government. In the event of a major disaster or emergency, this often means the 
coordination, development, and delivery of time-critical, lifesaving information to all 
potentially affected people. For this reason, public officials and government 
spokespersons often find that this aspect of their jobs is different in an emergency 
environment, and more important. In a climate of heightened uncertainty and concern, the 
timing and content of official statements can save lives, the media and general public are 
likely to scrutinize statements more, and some statements could incur heightened political 
liabilities. 

This section examines the use of policies, 
procedures, and mechanisms employed by 
participating FSL governmental departments 
and agencies and/or non-governmental 
organizations (NGOs) to communicate with 
the public in response to potential and actual 
INS in the course of the T3 FSE. This 
included governmental interaction with media 
outlets — Virtual News Network (VNN) live 
television; VNN.com website: and notional 
radio, print, and other media outlets (press 
releases). This also included other means of reaching the public with official lifesaving 
information, including the use of hotlines, call centers, agency website postings, e-mails, 
blast faxes, flyers, and reverse 91 1 to telephones and cell phones of citizens. All of the 
National Response Plan (NRP)-related coordination structures and mechanisms used by 
FSL governmental agencies during the exercise to develop and deliver messages to the 
public are also examined.^ 


"Communicating in a major emergency situation, 
particularly a terrorist event, is very different from 
communicating about routine matters or smaller 
crises...ln ordinary circumstances, your role is to 
provide the public with information. This role does 
not change during the extraordinary time of an 
emergency, such as a terrorist attack, but the 
stakes are much higher." 

Incident Communications Emergency Reference: 

A Guide for Communications Professionals 


Transcript-level notes for VNN; press releases; VNN.com archive.s; follow-up discussions with media 
Simulation Cell (SIMCELL), VNN, and public affairs officials; and the T3 FSE searchable reconstruction 
database, which incorporates agency situation reports and logs and data colleclor/analyst and media 
SIMCELL logs served as inputs to this analysis. 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

160 






AAR 


TOPOFF 3 


B. Background 

Public affairs officials have long noted that, with terrorism, a local attack can be national 
in impact and in importance. Public information emerged as one of the most frequently 
referenced issues in the T2 exercise cycle, as well as in the Senior Official Exercises 
(SOEs) under the National Exercise Program (NEP). 

C. Accomplishments since the T2 FSE 

The Department of Homeland Security (DHS) has led the continued development of a 
national public affairs framework since the T2 FSE. Major accomplishments in this 
regard include: 

• the development and release of the NRP Incident Communications Emergency 
Policy and Procedures (ICEPP), comprised of the Emergency Support Function 
(ESF) #15 (External Affairs) and Public Affairs Support Annexes; 

• the development of the associated Incident Communications Emergency 
Reference (ICER), which provides tactical guidance to Federal incident 
communications professionals; and 

• active participation in the NEP-sponsored SOE process to bring visibility to 
critical incident communications issues. 

D. Development and Release of NRP ICEPP 

The ESF #15 Annex to the NRP addresses emergency public information and protective 
action guidance, media and community relations, congressional and Indian affairs, and 
tribal/insular affairs. It states that it provides the resources, mechanisms, and structure to 
implement the NRP ICEPP. The DHS Assistant Secretary for Public Affairs, in 
coordination with the NRCC, directs activation and implementation of ESF #15. 
Resources available to support ESF #15 include the Emergency Alert System and other 
emergency broadcast systems. A DHS/Emergency Preparedness and Response 
(EPR)/FEMA Public Affairs staff member represents ESF #15 functions at the NRCC. 
During an INS, ESF #15 activities are coordinated by Office of Public Affairs (OPA) 
representatives of the Homeland Security Operations Center (HSOC) and llMG. 

The Public Affairs Support Annex outlines the policies and procedures to “rapidly 
mobilize Federal assets to prepare and deliver coordinated and sustained messages to the 
public in response to Incidents of National Significance.” It describes the entities and 
mechanisms involved in incident communications coordination, such as Joint Information 
Centers (JICs). It also describes the types of incident communications coordination that 
occur at various stages (prevention, preparedness, response, and recovery) of an INS. It 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

161 





AAR 


TOPOFF 3 


provides a checklist of the types of activities that should be conducted in the first hour, 
day, and week of a response to an INS. 

Together, the ESF #15 and the Public Affairs Support Annexes outline organizational 
roles, tools, and mechanisms available to support incident communications coordination, 
generally describe these resources and tools, and provide general message development 
considerations. They do not provide guidance on how these roles, tools, or mechanisms 
could or should be used by FSL entities to coordinate a consistent message. 

E. Development of ICER 

The ICER was developed to provide public affairs officials with “basic information on 
homeland security public affairs organization, communications response activity for an 
incident and contact information.” ' It introduces readers to the Homeland Security 
Advisory System, provides guidance for what to do before an incident (such as “Develop 
a Public Affairs Action Plan,” “Develop relationships with responders in your area,” and 
“Train your leadership on your Action Plan,” etc). It outlines “message components” 
such as “expression of empathy" and “clarification regarding steps being taken to obtain 
more facts,” etc. It provides a “First 48 Hours Checklist.” which outlines steps such as 
notification of leadership, “Contact local, State and Federal partners now,” and “Connect 
with the JIC.” It encourages early outreach through a basic formal statement to the media 
and “partners” and encourages sharing “pre-cleared facts,” as well as what steps the 
agency is taking to support the emergency with the public. Finally, it provides a State 
Public Affairs Contact List and numerous templates (e.g., press release template). It 
focuses on what steps should be taken to conduct and coordinate public affairs, with less 
emphasis on how coordination should occur. 

F. Participation in the SOE Process 

Four discussion-oriented tabletop exercises (TTXs) were conducted for senior Federal 
officials prior to the T3 FSE. These TTXs covered a range of topics and scenarios. Two 
exercises, SOEs 05-2 and 05-3, used the T3 FSE scenario. The purpose of the SOEs was 
to prepare top officials for participation in the T3 FSE. 

Since the T2 FSE, DHS has also: 

• Implemented the DHS Office of Public Affairs Coordination Center, or “Ready 
Room,” which serves as the public affairs “nerve center” in an emergency. There, 
DHS officials staff the National Incident Communications Conference Line 
(NICCL), as well as telephone lines dedicated to communications with the State 
JICs and with DHS intra-agency, international, and special media. The NICCL is 


Table 1 of the NRP Public Affairs Support Annex, Interagency Incident Communications Planning 
Guide. 

' ' ICER Introduction Letter, Susan Neely. DHS Assistant Secretary for Public Affairs. 

SOE 05-2 used the bioterrorism scenario and 05-3 used a combined biological and chemical attack 
scenario. 
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a standing conference line maintained by DHS Public Affairs as the primary 
means for interagency incident communications information sharing during an 
INS.'^ In the Ready Room, DHS personnel also check and record facts, monitor 
the media, develop talking points, support speech writing, and provide support to 
other functions as needed. 

• Initiated and finalized an international agreement between the United States and 
the governments of Canada and the United Kingdom (UK), pledging mutual 
support to coordinated incident communications efforts in emergencies. DHS held 
two pre-FSE exercises with incident communications offices from Canada (with 
some limited UK participation) in order to .strengthen and rehearse the logistics 
supporting this aspect of international collaboration. 

• Created the Incident Management Public Affairs Coordination Committee. The 
White House Communications Office and Homeland Security Council (HSC) 
oversee this committee, which is coordinated by DHS OPA and is comprised of 
representatives from 15 Federal departments and 12 Federal agencies/independent 
bureaus. It meets quarterly to exchange lessons learned and to promote teamwork 
within the public affairs community for managing incident communications. 

• Actively participated in the Public Affairs Working Group, which involved the 
FSL public affairs offices that participated in the T3 FSE. 

G. Reconstruction 

This reconstruction focuses on how the public affairs design elements facilitated 
exercising incident communications. 

The DHS-sponsored TOPOFF exercise series offers FSL and NGO top officials and 
public affairs professionals the mo,st challenging and realistic environment of any 
exercise. The T3 FSE incorporated three elements for multi-dimensional incident 
communications play — VNN Live simulated television coverage, VNN.com simulated 
electronic print media, and a robust media simulation cell. Together, these entities made 
more than 1,000 phone calls over five days to nearly 340 public affairs participants. 
These elements provided top officials and their supporting public affairs staffs with a 
challenging and realistic opportunity to gain experience interacting with the media during 
an unfolding disaster or emergency. 


The NICCL is not a tool for coordinating Federal response operations. 

Nearly 340 public affairs participants registered to be “pushed” by simulated media. This does not 
include additional public affairs participants with support roles. 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

163 





AAR 


TOPOFF 3 


/. VNN Live 

YNN Live provided more than 35 hours of 
original and live coverage during the course of 
the exercise. It employed five news studios with 
nationally known television anchors and 
experienced reporters in each venue who 
challenged spokespersons in the exercise as they 
would in a real event. VNN conducted more 
than 140 live interviews and 13 press 
conferences during the exercise.'*' The VNN 
news desks and reporters incorporated 
department/agency (D/A) press releases, stories 
that were posted on VNN.com, and news 
gathered via the simulated wire services into their interviews with spokespersons, much 
as would occur in the real world. 

2. VNN.com 



VNN.com simulated print media 
through an electronic website that 
was available to organizations 
participating in the T3 FSE. Nine 
news editors located across the five 
exercise venues posted more than 200 
articles throughout the FSE based on 
information gathered through D/A 
press releases, press conferences, and 
the media simulation cell, A total of 48 FSL and private sector organizations posted more 
than 130 public messages on VNN.com.'* VNN.com also included articles based on 
interviews with incident communications participants. The website streamed 35 hours of 
VNN Live video over the course of the exercise, providing a wider reach for VNN Live 
coverage. More than 8,000 individual users logged onto VNN.com during the exercise, 
providing an indication of the widespread use of this media outlet. 

3. Media SIMCELL 

Acting as a news wire service, five media simulators located in the three domestic venues 
supplemented VNN Live and VNN.com by calling FSL Public Information Officers 
(PIOs) to ask questions and conduct telephone interviews. The intent of the Media 
SIMCELL was to put “media pressure” on the entire incident communications system in 
accordance with the objectives of participating D/As. It reached many players who would 



Source: T3 VNN Broadcast Log. 
Source: T3 PIO Play Summary Report. 
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not have otherwise been challenged by incoming calls from reporters.'^ The Media 
SIMCELL also followed up on stories that played on VNN Live and, in some cases, fed 
news stories to the VNN News Desk operation based on the information it gathered, 
much as a wire service would do. 

H. Consequence 

DHS has initiated a number of initiatives designed to facilitate better coordination of 
public messages among FSL and international governmental agencies, the private sector, 
and NGOs. Progress has been made in the provision of guidance (the NRP ICEPP and 
ICER). tools (NICCL), and other resources (regular dissemination of DHS public affairs 
guidance in an incident) since T2. Future efforts should seek to further define concepts 
for how these tools can be better used to promote more consistent messages by FSL 
governmental agencies. Particular emphasis should be placed on the development of an 
efficient Joint Information System (JIS) concept. 

The provision of early, unified, and accurate lifesaving protective action guidance by top 
officials in time-sensitive scenarios, such as those examined in the T3 FSE, should be a 
top priority in public affairs initiatives. This represents a low-cost, yet highly effective, 
method that could substantially reduce the number of casualties in these types of 
incidents. Federal officials (in addition to State and local officials) may need to be 
prepared to provide comprehensive and specific protective action guidance to the public 
in the event of an attack with widespread implications, such as a bioterrorism attack using 
a contagious agent. 

I. Analysis 

Since the T2 FSE, substantial progress has been made in creating coordination 
mechanisms to promote the release of a more consistent message by FSL governmental 
agencies. There was no overarching incident communications framework or guidance 
during the timeframe of the T2 FSE, as DHS had only recently been created. For this 
reason, incident communications play in that exercise could only be examined in terms of 
outcomes based on general incident communications principles — how consistent, 
accurate, and timely were the messages provided to the public by FSL agencies across the 
various phases of the incident. 

The NRP and its annexes, the National Incident Management System (NIMS), and the 
ICER allow a framework for examination of how incident communications were 
executed. The T3 FSE is still examined in the context of the outcomes — incident 
communications principles of consistent, accurate, and timely messages still apply. 
However, it is recognized that no one agency can guarantee these outcomes across the 
range of independent authorities and stakeholders delivering messages to the public 
during an emergency, even if it is taking as many steps as it can to promote coordination. 

'^VNN Live and VNN.com components focused primarily on top officials and were charged with 
developing and disseminating news stories. They were not staffed to physically visit or call all PIOs who 
would be operating behind the scenes. 
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Therefore, the focus of this analysis is on examining the current incident communications 
framework as documented in the NRP, NIMS, and ICER in the context of the FSE to 
determine the relative strengths or weaknesses of this framework when implemented and 
to determine whether and what potential modifications may need to be considered to 
improve the framework or its implementation. Also, the purpose of this analysis is to 
provide a wide-angle perspective on the overall messages provided to the public, the 
potential implications of those messages, and the degree to which the delivery of the 
messages would have enhanced or detracted from the credibility of the spokespeople as a 
key element in a successful public notification campaign. 

I. Tools Implemented After T2 FSE and Used in T3 

The T3 FSE served as a “proof of concept” opportunity to introduce, test, and/or refine 
new DHS-sponsored public information coordination mechanisms, such as the NICCL 
and Ready Room. Prior to the exercise, the DHS OPA released informal preparatory 
guidance via e-mail to agencies participating in the FSE to further raise awareness of the 
key incident communications support tools that would be available in the exercise and to 
outline the purpose and usage protocols for the NICCL.'* It summarized the lead 
agencies for the scenario, outlined DHS Public Affairs products that would be prepared 
and distributed (such as Public Affairs News Updates, Public Affairs Guidance, NICCL 
updates, and web products), and outlined DHS incident communications contact 
information. It requested that Federal agencies provide courtesy copies of press releases 
and encouraged “wide distribution.” This helped build awareness of the available 
coordination tools and encouraged mutual awareness of respective messages that would 
be disseminated by Federal agencies. 

As designed, the NICCL served as the primary tool for interagency public affairs 
coordination during the exercise. The Federal Core Group convened on a regular basis 
throughout the exercise via NICCL teleconferences. Data suggest that, using the NICCL, 
the group coordinated agreements that outlined which agencies would address certain 
facts and outlined the generally consistent messages that Federal D/A spokespeople 
would relay to the public regarding Federal assistance to the affected areas, national 
preparations, protective measures, and Federal law enforcement activities. 

DHS provided informational updates up to 10 times a day on this conference call forum 
and published summaries for tracking purposes. DHS established a fairly regular morning 
and evening update cycle and announced other periodic updates via e-mail as well as on 
this line as needed. It was staffed 24/7 so that even outside of the formal, scheduled 
“updates,” callers could obtain information from a DHS public affairs official. DHS 
disseminated a written “NICCL Update” over e-mail after each of these updates to 
provide a record of the discussion. 

DHS also regularly disseminated Public Affairs Guidance (approximately four times a 
day and hourly in some cases) to provide the activated incident communications staffs at 


E-mail from Jeff Karonis. DHS Public Affairs, to interagency public affairs offices, dated April 1, 2005. 
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all levels with periodic updates on the evolving facts as DHS understood them. This 
guidance was intended to support a common information baseline across FSL 
organizations in a rapidly evolving event and represented a formal, written means of 
transmitting information. However, because the updates were rather general and did not 
contain details on specific public message content, it was not clear whether they were 
effective in promoting a consistent message. 

FSL D/As were inundated with general informational updates from other agencies who 
distributed regular situation reports, including other offices in DHS. The DHS OPA 
observed that, in the future, it may be more effective to send out sets of more specific 
“message points” rather than general status updates. The Public Affairs Guidance has the 
potential to contribute to more consistent messaging. Integrating it with NICCL updates 
may be another way to further streamline DHS incident communications support to the 
interagency and enhance its perceived value by establishing it as a definitive “go-to” 
product during an incident. 

More consideration should be given to further refining and formalizing the business 
processes that define how the new incident communications coordination tools are used. 
A concept of operations document could be useful to reinforce awareness of these tools 
and to outline how they can be even better used by Federal agencies (as well as State and 
local governments) as a backbone to a JIS to promote a more consistent message. Also, 
it could be useful to expand the NICCL forum to a .secure web-based collaboration 
environment (e.g., using technology similar to that of WebEx'“) to enable participants to 
hear and see updates. Collaboratively maintaining a written file that is periodically 
updated by participating agencies, and in which facts are mutually vetted, could 
contribute further to a common operational picture. 

2. Agencies Adhered to the NRP and ICER Guidance 

a. Public Affairs Mechanisms 

By using a variety of means to reach the public, making joint public statements, and 
actively working to control rumors, agencies adhered to the NRP and ICER Guidance. 
FSL D/As employed many systems and tools to reach the public. Both New Jersey and 
Connecticut deployed central information hotlines and websites, which served as 
cornerstones of multifaceted public information campaigns.^' Both States activated their 
hotlines on April 4. Connecticut fielded questions from individuals throughout the first 
day. New Jersey kept its hotline and associated e-mail operations open all week to 
receive and respond to inquiries from the public. Both hotlines provided multilingual and 


See related issue and Course of Action (COA) on JICs. 

WebEx is an integrated collaborative meeting and audio/visual teleconferencing services provider. More 
information can be found at hllp://www. webex.com and 
http;//www.pcmag.coin/article2/0, 1759, 1787545 .OO.asp. 

The NJ telephone hotline (866-234-0964) was announced via a press release at 13:58 on April 4. The CT 
hotline (21 1) was announced via a 17:00 press release on April 4. 
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text telephone (TTY) services. The telephone numbers were regularly included on press 
releases produced by the State and, in some cases, local governments. 

FSL D/As also provided informational websites and phone numbers, including dedicated 
resources for mental health support. Some ijeople may have found the volume of public 
information telephone numbers overwhelming or difficult to track.^^ However, the State 
hotline numbers and the American Red Cross’s contact information were the ones most 
frequently presented. Maintaining and publicizing a centralized list of the various 
numbers would be useful. 

b. Message Considerations 

Generally speaking, the public messages from top FSL officials satisfied the following 
guidelines offered in the ICER: 

• Expression of empathy 

• Clarification of facts 

• What is not known 

• Steps being taken to obtain more facts 

• Call to action (giving the public things to do) 

• Referrals (where to go for more information) 

In press releases and via VNN, Federal officials provided regular and generally consistent 
updates regarding Federal assistance to the response efforts in New Jersey and 
Connecticut. DHS, Department of Health and Human Services (HHS), and Centers for 
Disease Control and Prevention (CDC) officials consistently directed the public to listen 
to State and local government officials for protective action guidance and specific 
informational updates. This is generally consistent with the NRP. which states that: 

State, local and tribal authorities take a lead incident 
communications role in their respective jurisdictions, while the 
Federal core group coordinates communications covering Federal 
assistance to the affected areas. FSL D/A response, national 
preparations, protective measures and Federal law enforcement 
activities. 


Sampling of informational numbers, not including websites, provided during the T.t FSE: Connecticut : 
Hotline (21 1 ); Family Assistance Center (800-438-4636). Interagency : American Red Cross (866-446- 
2600 and 999-867-6333); Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) (888-ATF- 
BOMB); CDC (800-CDC-INFO); HHS information (866-509-8000); Federal Bureau of Investigation 
(FBI) (800-FBl-TIPS); Will Backus Disaster Information Line (866-425-3855). New Jersey : Department 
of Health and Senior Services (DHSS) Hotline (866-234-0964. 609-633-2083, and 866-555-5555); 
Medical Examiner’s Office (201-599-6097 or 292-6468); Victim Hotline (609-292-6468); Mental Health 
Hotline (800-294-4357); TTY (973-571-1898). Local health departments provided individual numbers. 
The Wall Street Journal and Wa.'shington Post (among other publications) published consolidated lists of 
contact information for relief organizations in the aftermath of the December 2004 tsunami. 
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New Jersey provided some strong public health and law enforcement spokespeople early 
on, in addition to the Governor, who likely would have helped establish the credibility of 
government leaders. They provided a comprehensive informational presence regarding 
the unfolding crisis. The State Epidemiologist established himself early on as a credible 
spokesperson regarding the unfolding health crisis and made regular and frequent 
appearances on VNN. The Superintendent of NJ State Police provided authoritative 
messages regarding law enforcement updates early on as well. 

c. Joint Statements 

There were also numerous examples of joint appearances and public statements by 
various combinations of FSL officials, which helped to convey a coordinated response to 
the public. The Secretaries of DHS and HHS provided joint statements on April 4 at 
12:20 and then again at 17:00. State officials in New Jersey and Connecticut also 
conducted some joint interviews. On April 4 at 15:00 and April 5 at 14:00, the Governor 
of New Jersey, Commissioner of DHSS, and State Epidemiologist made a joint 
appearance on VNN. Also in New Jersey, at 13:20 on April 5, the Deputy Superintendent 
of the NJ State Police appeared with the State Epidemiologist. In Connecticut, the 
Governor and PFO made two joint appearances and were joined the second time by the 
FBI Special Agent in Charge (SAC) overseeing the investigation. Senior CT State 
departmental officials appeared together twice on April 6. Also in Connecticut, key local 
officials appeared together on VNN. Although there were still problems in the 
consistency of messages provided by these officials across FSL levels, joint appearances 
represent one way to convey that the government is working together for a unified 
response. 

d. Rumor-Control Efforts 

Throughout the T3 FSE, Federal and State D/As acted to correct misinformation or 
rumors reported through media channels. DHS staffed its Ready Room with a dedicated 
media monitor to assist with rumor control and to reconcile instances of conflicting 
information. For example, on April 7. the HSC, in coordination with HHS and CDC, 
released talking points to correct erroneous statements by other spokespeople referring to 
the availability of a “vaccine” for plague. In New Jersey, DHSS made “clarifying VNN 
rumors" one of its top priorities. The State PIO in Connecticut used its 211 hotline to 
combat rumors. The CT Department of Environmental Protection (DEP) released a press 
release the afternoon of April 6 to specifically clarify that a rumor “regarding a chemical 
spill that allegedly occurred in the area of the explosion in New London” was false. 

3. Distribution of Domestic Incident Communications Spokespersons/Agencies 

The distribution of domestic incident communications spokespersons/agencies reflected 
NRP ICEPP guidance. Nearly 50 FSL agencies, private sector entities, and NGOs 
provided messages to the public during the T3 FSE. Of these organizations, DHS 
provided the most messages in the form of VNN appearances by the Secretary and other 
officials and press releases reported on by VNN.com reporters. The American Red Cross 
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and HHS were the next most-visibJe Federal agencies, followed by the Department of 
Transportation (DOT) and FBI. Such visibility was consistent with the decisions and 
response activities occurring at the Federal level. Figure Il-l depicts the total number of 
public messages made or issued by primary spokesagencies on VNN or via press 
releases."^ Figure II-2 shows the total number of VNN appearances by a spokesperson or 
agency. Figure II-3 identifies the total number of press releases issued by participating 
domestic organizations. 

Figure II-l. Overall Incident Communications (VNN and Press Releases) 
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In New Jersey, the Governor and lop DHSS officials led incident communications in the 
early stages of the plague outbreak, as evidenced by the number of their VNN 
appearances and press releases. Their leadership was supplemented by widespread press 
release activity by localities after the decision was made to execute a statewide 
prophylaxis strategy. Middlesex County, one of the two hardest hit counties in the State, 
issued press releases that were especially thorough and informative. 


^ Note that only primary NRP-related agencies are reflected in Figure It-I . Also, only Union and 
Middlesex Counties in New Jersey (the two hardest hit counties) are included in the summary figures, 
because most other county press rclease.s were largely focused on providing information or updates 
regarding points of dispensing (POD.s). 
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Figure 11-2. VNN Appearances by Primary Spokesagencies 
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It should be noted that the incident communications approach to the prophylaxis strategy 
in New Jersey in T3 was more Stale-centric than that of Illinois during the T2 FSE. In 
that exercise, the city of Chicago and the surrounding “collar” counties assumed more 
localized control of incident communications when they issued joint press releases with 
instructions to the public on PODs.‘* This resulted in more consistent messages regarding 
PODs than occurred in T3. which will be discussed in a later section. However, joint 
press releases would have been harder to coordinate in New Jersey due to the 
participation of a large number of counties. 

In Connecticut, the Department of Emergency Management and Homeland Security 
(DOEMHS) provided the most public messages overall, followed closely by the JIC, 
which was more active than its counterpart in New Jersey. Top local officials, namely 
the New London City Manager and Mayor and the Governor, led televised public 
messaging. Health officials were less visible in televised messaging in Connecticut, 

The differences in the approaches in New Jersey and Connecticut likely reflected the 
differing implications of the incidents — a distributed biological attack in New Jersey 
versus a localized explosion and chemical attack in Connecticut. There were instances of 



^ T2 FSE After-Action Report. 
See later section on the JICs. 
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inconsistent messages among organizations within each venue, particularly regarding 
protective action guidance, which will be discussed in a later section. However, the 
distribution of public messages overall reflects NRP incident communications guidance 
and indicates that the guidance is flexible enough to accommodate varying 
implementations. 
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Figure 11-3. Press Releases Issued 
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4. Top Officials ' Difficulty in Providing Protective Action Guidance to the Public 

Despite the changes implemented since the T2 FSE, top officials in T3 still were not able 
to provide timely, accurate, and consistent lifesaving protective guidance to the public. 
FSL top officials in both venues did not provide a clear and consistent message on 
recommended protective actions for the public to reduce risk in the early hours and days 
after the attacks. In many instances, this information was provided only when asked for 
by a reporter. The inconsistencies and delays in such guidance could have had significant 
implications on the number of casualties in both venues.^’ Early and consistent guidance 
could minimize the exposure rate and/or degree of exposure to WMD agents. 

a. New Jersey 

By late morning on April 4, a presumptive diagnosis of plague was confirmed, and a 
bioterrorism attack was suspected. The agent suspected to be the cause of the first 
fatalities would have been released from one to six (or more) days earlier.^* This would 
have heightened the criticality of a swift and uniform response, at least in terms of 
preliminary protective action guidance. Officials did not appear to convey the potential 
magnitude of risk that could be associated with an intentional, covert terrorist release of 
Yersinia pestis in the first day. This could have been out of a desire to not unduly alarm 
the public while public health strategies and resources were being mobilized. But, 
officials may need to assess whether the tradeoffs associated with this approach are worth 
the risks. 

Federal officials were uniform in directing the public to consult State and local officials 
about specific protective action guidance. This is consistent with the NRP, which 
recognizes the leadership of State and local governments in directing the response to 
terrorist attacks. But, the potential for national casualties in the event of a contagious 
biological attack may call into question whether Federal officials, especially in the early 
hours, may need to also provide specific protective action guidance at the national level. 
The public, especially those in potentially at-risk areas that are not at the epicenter of an 
outbreak where State and local guidance may be more plentiful, may look to Federal 
spokespersons for uniform protective action guidance. 


The emphasis here is both on inconsistencies and delays, rather than just inconsistencies in messaging, 
because effective response to the two scenarios in T3 is so time-sensitive. 

This range is based on the incubation period for Yersinia pestis. The release lime could not be precisely 
estimated based on a single case. 
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Some examples of inconsistencies and delays in protective action guidance in New Jersey 
are provided below to illustrate these points. 

i. Criticality of the 24-hour Timeframe for Taking Antibiotics after the Development of 
Symptoms 

Initial statements by State officials on VNN did not communicate the criticality of the 24- 
hour timeframe for receiving antibiotic treatment. On the afternoon of April 4, the NJ 
Governor mentioned that plague is treatable with antibiotics, but did not specify the 
criticality of treatment within 24 hours of the onset of symptoms. The DHSS 
Commissioner noted on VNN on April 4 that plague “has a high fatality rate,” but did not 
clarify that this is true only if someone who is infected does not receive antibiotic 
intervention within 24 hours from the onset of symptoms, and that otherwise plague is 
highly treatable. By April 5, subsequent press releases from State and local D/As did 
begin to emphasize that “early” antibiotic treatment was critical. 

ii. Inconsistent Respiratory Precautions 

Also, FSL officials did not widely or uniformly disseminate disease prevention 
information, such as avoiding symptomatic individuals or wearing surgical masks, to the 
public on the first day. The Deputy Superintendent for the Homeland Security Branch of 
the NJ State Police, when asked in a VNN interview on April 4 at 15:10, stated that her 
office was “staying six feet away from other people.” Although this was good protective 
action guidance, it was not widely provided by other State and local officials or 
mentioned by other officials on VNN on the first day.'^” In a real event, such early 
guidance could save lives and reduce the wave of secondary exposures. Due to the 
potential initial exposure time frame, this could have been critical information for some 
people. 

iii. Uncoordinated and Unnecessary Precautions 

Some organizations provided protective action guidance that proved to be unnecessary 
and was not coordinated through State health officials. This could have undermined the 
credibility of officials providing critical guidance requiring public cooperation. In one 
example, the NJ American Water Company issued a “boil water advisory” the evening of 
April 4 which was not coordinated with State health officials. The DEP initially stated 
that “a potential or actual threat to the quality of the water being provided currently 
exists.” The State Epidemiologist noted in an interview on VNN on April 5 that plague is 
not transmissible from water and that he was unclear on the rationale for this order, but 
that it was “not due to plague.” The NJ American Water Company ended its boil water 
advisory at noon on April 6, describing it as a precautionary measure due to staff 
shortages resulting from the emergency. The Governor issued a press release that day 


DHSS issued a press release on April 4 at 2 1 :56 referencing the criticality of the 24-hour window for 
receiving antibiotics; however, it appeared in the 33rd sentence of the press release after updates on 
casualty figures, POD openings, and general information regarding plague. 

^ Union County mentioned this in a press release on April 5. 
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Stating that there is “no threat of disease transmission from the State’s water supply.” In 
this same statement, DHSS reaffirmed that there was no need to boil tap water. These 
inconsistent messages could have triggered a degree of unnecessary concern among the 
public. 

iv. Uncoordinated POD Guidance 

Initial public guidance relating to the PODs and prophylactic treatment was mixed and 
could have had negative implications on disease spread. First, VNN anchors reported 
receiving conflicting information from State officials on whether and when initial PODs 
would be opened the morning of April 5. Officials initially instructed members of the 
public to report to PODs if they thought they were in the initial exposure area or they 
thought they were exposed to someone who was. No specific guidance was given as to 
how a person would know if he or .she were in the exposed area (it was not specified) or 
exposed to someone who was. Initially, VNN reported a strategy of triaging people who 
were in-processing at the PODs by creating separate lines for symptomatic and non- 
symptomatic persons. This approach was changed the next day (at which point, 
symptomatic people were instructed to report to a hospital rather than a POD), but could 
potentially have exposed people to plague on the first day. Later, this guidance evolved — 
reflecting a decision by the State to conduct statewide prophylaxis rather than a targeted 
campaign — and everyone in the State was instructed to go to a POD unless they were 
symptomatic, in which ca.se they were to report to a hospital. 

There were also inconsistencies among local jurisdictions in messages relating to the 
PODs organized by the State.^' Some mentioned the need to arrive with a completed 
registration form, whereas others did not. In an April 6 press release, Cape May County 
officials mentioned that the weight for children less than 100 pounds needed to be 
correctly recorded on the form, whereas other counties did not specifically mention this. 
A few counties reminded residents in press releases that if they did not speak English, 
they would need to bring a translator.’^ How this message would have been conveyed to 
those populations was not clear. Gloucester County noted in a press release issued on 
April 6 that if you have not been exposed and are not ill, “the best thing you can do is 
stay home.” However, no specific guidance was provided as to how to know whether you 
had been exposed. Also, by this time the State had decided to implement statewide 
prophylaxis. 

Throughput at the PODs was a critical variable in the State’s ability to successfully 
implement its POD plan within the 48-hour timeframe it had established. Incomplete 
guidance to the public could have negatively affected throughput if people arrived 
unprepared at the PODs, State governments should develop complementary incident 
communications plans for Strategic National Stockpile (SNS) distribution and should 
work closely with all affected localities to ensure that the guidance to the public provided 
by localities is clear and comprehensive. 


See also “Strategic National Stockpile and Point of Dispensing. ” 

Cumberland and Salem Departments of Health and Somerset County, April 6 press releases. 
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b. Connecticut 

In Connecticut, similar problems arose with the swift, accurate, and consistent provision 
of potentially lifesaving guidance. Delays in issuing decontamination guidance and cross- 
contamination warnings could have exposed more people to the agent, worsened the 
severity of symptoms, or contributed to the overflow of people at hospitals. Some 
examples of inconsistencies and delays in protective action guidance in Connecticut are 
provided below to illustrate these points. 

i. Delayed Protective Action Guidance 

An explosion was reported at the waterfront in New London around 13:20 on April 4. 
Data suggest first responders almost immediately suspected a chemical agent that could 
be sulfur mustard. VNN.com reported that, shortly after the blast. State hazardous 
materials (HAZMAT) workers at the city pier suspected that a chemical agent had been 
dispersed in the air. Rescue workers told reporters that the victims had been complaining 
of blistering skin rashes and trouble breathing — common symptoms of mustard exposure. 
The supervising emergency response coordinator with the State DEP stated, "We were 
immediately told of the skin blistering by the incident commander, and our workers put 
on their protective gear.” When asked by an interviewer about live footage depicting first 
responders in personal protective equipment, the New London City Manager first 
mentioned the word "contamination” on VNN at 14:24 on April 4. The CT Governor, 
accompanied by the New London Mayor, mentioned the potential use of an unspecified 
“chemical” in her first press conference to address the attacks at 14:40. Two hours later, 
the New London City Manager confirmed on VNN the presence of sulfur mustard and 
the suspicion that it might have been released prior to the explosion, extending both the 
time window of exposure and the size of the potentially exposed population. 

The CDC Fact Sheet on sulfur mustard indicates that the lack of immediate, widespread, 
self-decontamination guidance and cross-contamination warnings in the early hours of an 
attack could have had dramatic implications on the severity of casualties.” It indicates 
that symptoms for the skin, eyes, and respiratory tract can begin as early as one to two 
hours after severe exposure, increasing the criticality of swift protective action guidance 
within the first day. It further states that “getting the sulfur mustard off as soon as 
possible after exposure is the only effective way to prevent or decrease tissue damage to 
the body.” Yet, no specific protective action guidance was offered by State and local 
officials in these early hours regarding decontamination procedures, no warnings were 
issued in terms of potential cross-contamination, and no widespread emergency bulletins 
were issued stating that people at the waterfront during, as well as prior to, the explosion 
may have been exposed. 


hItp;//www.bt.cdc.gov/agent/sulfurmustard/basics/t'acts.u.sp 
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ii. Inconsistent Decontaminalion/Cross-Contamination Guidance 

Officials were also inconsistent in alerting the public to the risks of cross-contamination 
(which may have put more people at risk) and in issuing decontamination guidance 
(which may have worsened the severity of the attacks and contributed to the ensuing 
hospital overflow problems). Shortly after this, the New London Mayor instructed people 
at the waterfront to “walk away from the waterfront and walk home” if people could not 
drive or obtain a ride home. The guidance to walk home or drive home would have 
exposed these individuals to greater risk as the chemical (later reported to be odorless) 
would have had more time to penetrate clothing and they would have unwittingly cross- 
contaminated other surfaces such as car seats or their homes. It was not until 16:40 on 
April 6 that an official (the Commissioner of the Department of Public Health) stated that 
sulfur mustard was “passable” from one person to another. At this time he also advised 
that “if you have shoes or clothing that may have contacted outside surfaces, keep [them] 
in [a] plastic bag outside.” 

The Secretary of Homeland Security instructed people in his 17:00 press conference on 
April 4 to “among other things, use soap and water to wash your hands if you were in the 
vicinity” of New London, but did not mention any other specific guidance. A VNN.com 
story early in the morning on April 5 quoted a New London City Police sergeant who 
stated that 911 dispatchers were telling callers that, if they thought they had been 
contaminated by mustard, “they should shower with soap and water and put clean clothes 
on before going to the nearest hospital emergency room.” Guidance to wash with soap 
and water contrasted with the CDC Fact Sheet, which states that only “plain water” 
should be used to wash contaminated areas. Also, the guidance to report to a hospital 
after showering was unneces.sary (showering with water was an effective 
decontamination procedure) and seemed to contradict the State’s efforts to stem the flow 
of people to hospitals, which were reportedly overrun by this time. 

Finally, it was not clear why the Secretary of Homeland Security highlighted this 
guidance, but did not mention other personal protective action guidance. Federal incident 
communications experts should determine whether it is appropriate for Federal 
spokespersons, in addition to leaders of affected States/localities, to issue such guidance. 
If they determine that such guidance is appropriate at this level (as mentioned earlier in 
the case of a biological attack), they should prepare officials to provide comprehensive 
guidance. 

iii. Inconsistent Information on Water Risks 

There were also some inconsistencies in some of the information provided on sulfur 
mustard which could have undermined the credibility of officials and caused some 
confusion for the public. In one example, the Public Health Commissioner stated (on 
April 7) that sulfur mustard “does not affect the water supply,” and that the water supply 
was “secure assuming it is city water.” But, the CDC Fact Sheet states that “people can 
be exposed by drinking the contaminated water.” Also, officials were reporting that 
environmental testing was being done in the water, implying some potential for 
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contamination. Yet, other agencies were stating that water neutralized the sulfur mustard 
agent. A health official also stated that this agent “does not cause disease.” However, 
the CDC Fact Sheet states that it can cause chronic respiratory disease. Although this 
official was likely attempting to contrast this with the contagious plague epidemic, it 
highlights the importance of clear statements. 

iv. Inconsistent Shelter-in-Place Instructions 

Finally, officials did not provide comprehensive or consistent protective action guidance 
in Connecticut regarding the shelter-in-place order issued on the afternoon of April 4 for 
the New London area. First, the Governor mentioned closing all windows and doors and 
remaining on an upper floor without windows, as chemical mustard is heavier than air 
and will settle. An American Red Cross official later stated that windows and doors 
should be sealed with duct tape and ventilation turned off. stating that oxygen deprivation 
is “usually” not a problem within the (unspecified) time frames of such orders. The VNN 
lead anchor later strongly advi.sed against such procedures, noting that it could be 
dangerous due to oxygen deprivation and citing experiences from 9-11. But, the Public 
Health Commissioner provided similar and additional shelter-in-place guidance in a press 
release on April 5, advising the public to “close doors, turn off heating or air 
conditioning, close fireplaces, go to interior room without windows above ground, and if 
available, use duct tape and plastic sheeting” to seal all openings. 

Even by the next day. State and local officials were not consistent in their messages 
regarding the potential danger to the public from the chemical exposure. Live VNN 
footage of the incident scene showed first responders not wearing personal protective 
equipment on April 5. This led to questions on April 5 as to whether the Governor had 
lifted the shelter-in-place order and whether it was now safe to walk outside. She clarified 
on V7W Live on April 5 that she had not lifted this order due to the two- to three-day half- 
life of this chemical. But, local officials were reporting that it was safe to go outside at 
this time. An urban search and rescue commander stated on VNN around 1 1:00 on April 
5 that the shelter-in-place order was “an extra precaution,” but that the incident scene was 
safe. Shortly thereafter, the New London City Manager stated on VNN that “there is no 
reason to shelter in place.” 

Although some of these inconsistent messages were likely due to artificialities of the 
exercise, they illustrate a problem that can arise when jurisdictions have differing views 
on what constitutes “safe.” In this case, for whatever reason (even if artificiality- 
induced). local officials felt that the area was safe and began to communicate this in their 
statements. This conflicted with the position and guidance of the Governor and, at best, 
would likely have diminished the credibility of these spokespersons. At worst, the failure 
by officials (primarily at State and local levels as the leaders of public information on this 
attack) to provide early, accurate, and consistent protective action guidance could have 
increased the numbers and severity of casualties from the attacks. 


National Oceanic and A(nio.spheric Administration (NOAA) ofTicial on VNN on April 5 stated that 
water will “neutralize the agent.” 


UNCLASSIFIED - EOUe- 

This Document Contains Canadian and United Kingdom Information 

179 




AAR 


TOPOFF 3 


Tables II-l and II-2 depict the range of protective action guidance offered by officials 
within the first few days of the attacks. They illustrate the general lack of uniformity of 
initial protective action guidance across FSL public health and top officials in both 
venues, as well as the delays in some cases in the mo.st crucial first hours. Although some 
of the early disparity was due to artificialities, they suggest that officials may be 
unprepared to respond quickly to time-sensitive scenarios with consistent protective 
action guidance. Providing swift, accurate, and consistent protective action guidance in 
the immediate aftermath of an attack with time-sensitive implications (such as a 
biological or chemical attack) is one of the highest-impact actions officials can take. 
Providing this guidance should be a primary focus of incident communications initiatives. 
Of all the actions taken by FSL governments, this relatively simple action can 
dramatically reduce the .scale of casualties and ultimate cost of response. 
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Table II-2. First-Day Protective Action Guidance for the Biological Attacks in New 
Jersey 


Follow instruciions 
of State and local 
governments. 

Taking antibiotics 
if you haven't been 
exposed is not 
recommended. 


If you don't have 
symptoms and 
haven't been near 
anyone exposed, 
don't go to a POD. 


Bacteria can he 
transmitted by 
aerosol, direct 
contact with 
tissues, bixty fluids, 
or bites. 


You can reduce the 
chance of 
becoming sick if 
you receive 
preventive 
treatment within 
seven days of 
exposure. 


People 
experiencing 
respiratory 
symptoms should 
call their local 
hospitals prior to 
visiting a health 
care facility. 


Stay six feet away 
from people. 


Cover mouth when 
coughing/sneezing. 
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frequently. 


Slay home/avoid 
contact with olhen> 
if you don’t have 
symptoms. 





Use a cloth to 
cover mouth if 
surgical masks are 
not available to 
avoid contracting 
pneumonic plague. 

1 

1 

Fact 

Sheet 


If you are ill with 
pneumonic plague, 
you must receive 
antibiotics within 

24 hours of 
symptoms to 
prevent high risk of 
death. 

1 

4/5, 

13:34 

(PR) 

Fact 

1 Sheet 


If you are ill, cover 
mouth and nose 
with tissue or 
surgical mask when 
coughing/sneezing. 

1 


1 

1 1 
1 


Do not touch ill or 
dead animals (or 
wear gloves). 

■ 

4/5. 

13:34 

(PR) 

Fact 
i Sheet 


Eliminate sources 
of food/nesting for 
rodents and seal all 
openings larger 
than 2.5 inches. 

1 


■ Fact 
Sheet 


Treat cats/dogs/ 
homes for fleas. 

1 


Fact 

Sheet 

1 
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Do aoi allow pets 
to roam outdoors. 


Boil water for one 
minute. Do not 
drink lap water 
(even filtered 
water). 


Thoroughly cixik 
and wash fresh 
produce to reduce 
plague risk. 


Advise school fotxl 
providers and food 
banks to use 
biasecuriiy 
measures to 
thoroughly clean 
vehicles and 
equipment to avoid 
the spread of 
disease. 

Hunting in counties 
affected by plague 
is not advised. 


Be cautious of 
blood donation. 
(Advise blood 
hanks and tissue 
donor organi^ations 
to request deferral 
of donations from 
NJ, NYC. and 
Allentown, PA. 
which routinely 
collect blood in NJ 
and quarantine of 
donations accepted 
up to three weeks 
ago). 


If you have 
symptoms of 
plague, report to 
the hospital 
immediately. 

Apply insect 
repellant to 
skin/clothing to 
prevent flea bites, 
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Table II-3. First-Day Protective Action Guidance for the Chemical Attack in 
Connecticut 


(SIP) Ltx.k wirulows/dwirs. 


(SIP) Head to interior room, without 
windows above ground. 


(SIP) Ckhse fircpiaec and damper. 



(SIP) Make .sure radio is working. 


(SIP) Turn off all fans/ventilalion. 


(SIP) Use duct tape and plastic 
sheeting to seal all cracks and vent.s 


(SIP) Have a hard-wired phone in 
room. 


(SIP) Bring pets inside and bring 
additional ItMid and water for them. 


Walk/drive home from waterfront if 
you can. 


Use soap/water to wash hands if you 4/4. 

were in the vicinity. 17:00 

(VNN) 


Avoid any exposure. 



Fact 

4/4. 

Sheet 

17:50 

(VNN) 
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Do ttoi touch anyone if you think 
you've been exposed. 


Do not touch dead animals. 


Gel family disaster kit. 


Continue in .shelter in place due to 
two- to three-day half-life of sulfur 
mustard. 


Quickly reirtove any clothing that has 
liquid sulfur mustard on it. If 
possible, seal the clothing in a plastic 
bag. 


Seal any bags with contaminated 
clothes inside a second plastic bag. 


Immediately wash all exposed areas 
with soap/waier. Then report to a 
hospital for additional treatment and 
decontamination. 


Immediately wash any exposed part 
of the body (eyes, skin, etc.) 
thoroughly with plain, clean water. 
Eyes need to be flushed with water 
for S to 10 minutes. Do NOT cover 
eyes with bandages, but do protect 
them with dark glasses or goggjes. 


If you are showing symptoms of 
sulfur mustard exposure, contact your 
health care provider or seek medical 
attention. 


If someone has ingested sulfur 
mustard, do NOT induce vomiting. 
Give the person milk to drink. 


People can be exposed by drinking 
contaminated water or getting it on 
their skin. 
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5. No Evident Use of a JIS 

The NRP describes a JIC as “a physical location 
where public affairs professionals from 
organizations involved in incident management 
activities work together to provide critical 
emergency information, crisis communications, 
and public affairs support.” The NIMS is 
supposed to integrate multiple JICs into a JIS 
concept, which is designed to “ensure that Federal, State, and local levels of government 
are releasing the same information during an incident.”'’'^ It states that “The JIS provides 
the mechanism for integrating public information activities among JICs, across 
juri.sdiciions, and with the private sector and NGOs.” Although there is evidence of 
multiple JICs and individual agency incident communications operations across multiple 
jurisdictions, as well as within the private sector and NGOs, there is no evidence of the 
use of a JIS in the T3 FSE.^ 

Substantial evidence exists of the various FSL D/As courtesy copying JICs on press 
releases and vice versa. This may reflect the current interpretation by many people of the 
“coordination” role of JICs in the NRP and NIMS. There is also evidence of numerous 
one-to-one attempts to coordinate or validate information points between D/As. But, 
there is little evidence in either Connecticut or New Jersey of a structured mechanism for 
the JICs to receive regular updates from D/As or for the JICs to develop and disseminate 
message content across all D/As. Exercise data do not reveal how the JICs in each venue 
coordinated with each other and with D/As to systematically produce a consistent public 
message. The numerous inconsistencies in some of the core public messages suggest that, 
if such coordination existed, it was not sufficient. 

There was some evidence that the mock media found that obtaining information from 
JICs in both venues was slow due to the time-consuming process required to locate and 
validate answers.'^* This caused the mock media to go directly to individual D/As in 
many cases when quick updates or answers were needed. Other evidence suggests that, in 
some cases, representatives at the various JICs focused on supporting their D/As* 
incident communications needs rather than the coordinated message development 
mission of the JIC. Media SIMCELL logs also show that JIC staffs often did not have up- 


“(The JIS] integrates incident information 
and public affairs into a cohesive 
organization designed to provide consistent, 
coordinated, timely information during a 
crisis or incident operations." 

NRP 


DHS NIMS Fact Sheet, http://www.dhs.gov/dhspublic/interapp/press_release/press_release_0363.xml. 
^ In New Jersey, there was the Joint Field Office (JFO) JIC and a separate State JIC. In Connecticut, there 
was a JFO JIC and a local JIC in addition to incident-scene public affairs support. DHS hosted a virtual 
national JIC through the HSOC and its Ready Room. 

See discussion on protective action guidance issue. 

Media SIMCELL logs indicate that JIC staffs would take down questions over the phone, seek answers, 
and return the call once a validated answer had been obtained from the appropriate representative. In 
many cases, the Media SIMCELL had obtained the answer more quickly by directly contacting FSL 
D/As. 
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to-date information or were generally not well informed.^^ The information problems in 
the JICs may have been caused by a lack of colocation with the decision makers, which 
increased the coordination burden.'^ This problem may make some D/As reluctant to 
send their most experienced people to a JIC. For the JIC to fulfill its mission as a “focal 
point for the coordination and dissemination of information to the public and media,” it 
needs to be closely integrated with the decision makers who are directing incident 
response, recovery, and mitigation efforts. For example, at the Governor of New Jersey’s 
request, the State EOC established a dedicated State JIC to support his incident 
communications needs. 

Experiences in the T3 FSE and observations from subject-matter experts suggest that the 
current JIC and JIS concepts could benefit from further examination. The NRP is an 
overarching guidance document and does not describe a process for how JICs should 
work together within a jurisdiction or across jurisdictions. Likewise, NIMS refers to the 
JIS. but does not provide operational guidance for how it should be implemented; who 
should lead it; and how various JICs, jurisdictions, the private sector, and NGOs should 
interface with it. DHS is currently working to refine the JIC concept. In July 2005, the 
department hosted a summit to develop “enhanced JIC leadership/organizational 
processes.”"*' The lack of any evidence of the use of a JIS suggests that the JIS concept 
may need more operational definition. A supporting JIS Concept of Operations could 
provide amplifying implementation guidance for executing incident communications in 
the context of the NRP and NIMS. Future FSEs, in addition to reconstructions of real- 
world responses, could be used to test and refine evolving JIC and JIS concepts. Further 
examination of JIC implementation during real-world incidents would also help to 
determine whether the problems seen in T3 are common or the result of an artificial 
exercise environment. 

6. Pre-exercise Coordination between DHS and International Participants 

A number of preexercise coordination actions between DHS and the governments of the 
United Kingdom and Canada helped to enhance public information coordination. First, 
senior public affairs officials from the three nations successfully negotiated a formal 
“Communications Agreement regarding the coordination and management of public 
information and media relations between United States, UK and Canada for the 
international counterterrorism exercise planned for April 2005.” It served as a written 
agreement and outlined principles and a template for how these three governments would 
approach public information in this exercise. Although not legally binding, it did serve to 
formalize agreement on principles such as “sharing key messages, talking points and 


The reconscruction contains multiple references from the Media SIMCELL of JIC staffs not being well 
informed, causing reporters to turn to individual D/As for the latest information. They acknowledged 
relying more heavily on updates from individual D/As once they were active. 

* Media SIMCELL logs indicate that JIC staff would take down questions over the phone, seek answers, 
and return the call once a validated answer had been obtained from the appropriate representative. In 
many cases, the Media SIMCELL had obtained the answer more quickly by directly contacting FSL 
D/As. 

DHS OPA memorandum regarding Quicklook inputs, undated. 
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lines to take relating to the event,” and providing “early warning of developing issues 
which may generate media or public interest.” 

In addition to this, DHS initiated two pre-FSE exercises with State, local, Canadian, and 
UK public affairs officials to strengthen and rehearse the logistics of international 
collaboration on incident communications. Whereas the Communications Agreement 
documented the desired approach, the pre-FSE workshops enabled public affairs officials 
in Canada, the United Kingdom, and the United States to gain experience with the 
various tools that would be available to implement it, and the FSE provided an 
environment for these officials to practice the coordination. 

International coordination on public messaging can be difficult for a variety of reasons, 
including differing time zones, government information sensitivities, differing 
approaches/philosophies regarding sharing information with the public, and the larger set 
of coordinating organizations. But, these initiatives represented important steps toward 
building relationships and generating mutual agreement on principals that the three 
nations could agree on. 

Senior public affairs officials from Canada and the United Kingdom have indicated that 
participation in the T3 FSE was valuable in enhancing their real-world coordination 
efforts. 

U.S.-UK incident communications coordination was tested dramatically by the July 2005 
terrorist attacks in London. Public affairs officials in both nations credit the T3 FSE 
experience and the relationships developed during planning phases of the exercise with 
helping to facilitate incident communications coordination during this difficult time. A 
Canadian public affairs official stated that the relationships and lessons learned 
developed through the FSE have already helped to enhance Canada-U.S. communications 
in several recent incidents. 

7. Issues from Previous Exercises 

Table 11-4 highlights the evolution of incident communications since the T2 FSE. 
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Table 11-4. Comparison ofT3 FSE with Previous Exercises 


T2 FSE 

T3 CPX 

SOEs 05-2 and 05-3 

T3FSE 

tSSUES/OBSERVATIONS 

• PFOs observed a fack of 
coordination between FSL 
D/As and acted to improve 
this. 

• Public affairs 
coordinated public 
Information among 
participating 0/As 
based on the draft 
Incident 

Communications 
Emergency Plan 
orocedures. 

• Officials emphasized 
the need for 
coordinated 
messages. 

• DHS initiatives, such as the 
NICCL, helped to improve 
coordination between FSL 

D/As. 

• DHS and HHS released some 
joint messages. 



• Officials emphasized 
the importance of 
including medical 
experts in public 
messages regarding 
bloterrorlsm. 

• State health officials in New 
Jersey worked closely with the 
Governor and were very visible 

In public messaging regarding 
the bloterrorlsm attack and 
response. 

• Protective action guidance 
by Slate/local ofticiais was 
not consistent or 
comprehensive. 


• Participants stressed 
the importance of 
providing clear, 
lifesaving information 
Immediately to the 
public. 

• IlMGTTXs 
emphasized the role 
of public messaging 
to identify victims and 
limit secondary 
contamination. 

For example, the public 
needs practical sulfur 
mustard specifics: 
contamination 
avoidance, 
decontamination 
measures, and 
svmctoms. 

• Protective action guidance by 
State/local officials was still 
not consistent or 
comprehensive. This should 
become a top priority for 
public affairs staff. 

• State and local 
governments did not 
appear to have pre* 
coordinated, off-the-shelf, 
agent-specific fact sheets 
and did not appear to use 
those from the COC. 

tu 

1) 

.;V 

• Federal officials 
'A'.MUtodt^off-the- 
' ' eheets are 

,},i~paeded.to provide 
j' .'VJinfMdiats and, in 
.MilWme' cases. 

' 'ViNetavfrMi ouidance. 

• CDC Fact Sheets were more 
widely cited by State and iocal 
D/A$ in websites than in T2. 

• Multiple informational 
phone numbers were 
issued, but not released as 
a joint set. 



• Both States emphasized 
hotline numbers to streamline 
public information. 

• But, multiple informational 
phone numbers were still 
released in both venues. 

• Local Jurisdictions In 

Chicago (plague outbreak) 
issued joint press releases, 
which resulted in 
consistent instructions to 
the public regarding PODs. 



• POD Instructions for some 
local jurisdictions were 
Incomplete and could have 
slowed throughput. 

• FSL leaders In both venues 
conducted several joint press 
conferences or released joint 

statements. 
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T2 FSE 

T3CPX 

SOEs 05-2 and 05-3 

T3FSE 

• State and local officials 
used language that was 
either too technical or too 
vague and Interfered with 
clear messaging. 



• FSL officials generally used 
clear language when referring 
to the pneumonic plague 
outbreak and the chemical 
attack. 


J. Recommendation<i 

• Develop the mechanisms to prepare FSL top officials to provide swift, accurate, 
comprehensive, and consistent pKJtentially lifesaving protective action during a 
terrorist attack with time-sensitive implications, such as the scenarios used in T3. 
Also, while top Federal officials may direct the public to look to State and local 
leaders for protective action guidance for mo.st scenarios, they (pailicularly 
DHS/HHS officials) may need to be prepared to provide comprehensive protective 
action guidance in the event of an attack with national reach, such as a biological 
attack. 

• Develop a supporting JIC/JIS Concept of Operations (CONOPS) to complement ESF 
#15 and Public Affairs Annexes of the NRP and ICER to provide more specific 
operational implementation guidance for executing incident communications in the 
context of the NRP. Explore virtual means of exchanging information and developing 
joint messages. 

• Consider using future exercises to further test/refine protocols (which could be 
documented in the CONOPS), and educate stakeholder organizations on how incident 
communications coordination mechanisms such as the NICCL can be used to 
promote a common operational picture and coordinate message content where 
appropriate. 

• Consider expanding the NICCL to an audio/visual forum that allows collaborative 
tracking of the evolving facts and message points. 

• Expand the DHS Public Affairs Guidance product to provide more specific message 
points and consider linking it to NICCL updates. 

• Establish primary public information sources early in the incident, such as the State 
hotlines and websites established in New Jersey and Connecticut. 

• State governments should develop complementary incident communications plans for 
SNS distribution and work closely with affected localities to ensure that the guidance 
to the public provided by localities is clear and comprehensive. 
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III. Integrating Responses to INSs: Public Health Emergency and the 
Stafford Act — Task # III-3: Direct and Control Response Operations 

A. Summary of Issue 

The issue is that neither the NRP nor HHS CONORS provide sufficient guidance for 
coordinating assistance for incidents that are concurrently covered under a Stafford Act 
declaration and a public health emergency. During the T3 FSE. the Secretary of HHS 
declared a public health emergency in New Jersey under the authorities of the Public 
Health Service Act. As discussed in the section “Stafford Act Declarations," the President 
approved Stafford Act declarations for the incidents in New Jersey and Connecticut. 
Additionally, the T3 FSE was the first test of the recently released NRP and thus the first 
opportunity to examine the guidance the NRP provides in coordinating INSs. 

The T3 FSE revealed that the NRP does not provide adequate guidance for coordinating 
Federal operations and support under a public health emergency when a Stafford Act 
declaration is in effect. Specifically, the processes were unclear for requesting and 
coordinating Federal assistance under other Federal authorities in conjunction with a 
Stafford Act declaration. The relationship between the public health emergency and the 
Stafford Act declarations was further clouded by the lack of a clearly established HHS 
process for coordinating Federal-to-Federal support for public health emergencies. 
Additionally, the funding responsibilities of State and local governments under a public 
health emergency were not clearly defined. 

B. Background 

The NRP is an all-discipline, all-hazards plan that establishes a single framework for the 
management of domestic incidents. It provides the structure and mechanisms for the 
coordination of Federal support to State and local incident managers and for exercising 
direct Federal coordination of Federal authorities and responsibilities. Emergency public 
health assistance can be rendered under at least two separate Federal acts of enabling 
legislation: the Stafford Act and the Public Health Service Act. 

I. NRP 

As the PFO for domestic incident management, the Secretary of Homeland Security 
declares INSs and oversees coordination efforts for Federal operations and resources.‘‘^ 
The NRP is the Federal government’s plan to respond to an INS. An INS is defined as an 
incident that meets one of the following four criteria set forth in the Homeland Security 
Presidential Directive (HSPD)-5 and NRP: 

• A Federal D/A acting under its own authority has requested the assistance of the 
Secretary of Homeland Security. 


Homeland Security Presidential Directive/HSPD-5 Subject; Management of Domestic Incidents. 
February 28. 2003. 
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• The resources of the State and local authorities are overwhelmed, and State and 
local authorities have requested Federal assistance (such as a Stafford Act 
declaration). 

• More than one Federal D/A has become substantially involved in responding to an 
incident. 

• The Secretary of Homeland Security has been directed to assume responsibility 
for managing a domestic incident by the President. 

For INSs that are receive presidential declarations of disasters or emergencies. Federal 
support to States is delivered in accordance with relevant provisions of the Stafford Act. 
Although all declared disasters and emergencies under the Stafford Act are considered 
INSs, not all INSs require a Stafford Act declaration. As a result, the NRP describes basic 
concepts for operating under a Stafford Act declaration as well as for INSs covered under 
other Federal authorities (non-Stafford Act). 

2. Processes and Structures for INSs under Other Federal Authorities 

The NRP discusses how to coordinate an INS that is a non-Stafford Act incident.^^ The 
Secretary of Homeland Security designates a Federal Resource Coordinator (FRC) to 
serve as the Secretary’s representative in the field to manage Federal resource support. 
Federal agencies provide resources under interagency reimbursable agreements or under 
their own authorities, such as a public health emergency or the National Oil and 
Hazardous Substances Pollution Contingency Plan (NCP)."^ The NRP states that for an 
INS without a Stafford Act declaration, "the JFO serves as the focal point for 
coordinating Federal assistance to the requesting agency.” The NRP has a Memorandum 
of Agreement (MOA) — Mutual Aid for Incidents of National Significance (Non-Stafford 
Act) — that creates a framework for interagency mutual aid for Federal-to-Federal support 
in an INS. Federal agencies that are signatories of the NRP are signatories to the MOA, 
but the MOA needs to be activated. 


NRP Appendix 6 Overview of Support in Non-Stafford Act Situations. 

See discussion in “Emergency Response Operations under a Unified Command" for more information on 


the NCP. 
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3. Stafford Act 

The Stafford Act establishes the programs and processes for the Federal government to 
provide disaster and emergency assistance to States, local governments, tribal nations, 
individuals, and qualified private nonprofit organizations/^ The provisions of the 
Stafford Act cover all hazards, including natural disasters and some terrorist events 
(explosives, fire). Relevant provisions of the Stafford Act include a process for 
Governors to request Federal disaster and emergency assistance from the President. The 
President may declare a major disaster or emergency: 

• If an event is beyond the combined response capabilities of the Slate and affected 
local governments; and 

• If, based on the findings of a joint FSL preliminary damage assessment (PDA), 
the damages are of sufficient severity and magnitude to warrant assistance under 
the act. (In a fast-moving or devastating disaster, DHS/EPR/FEMA may defer the 
PDA process until after the declaration.) 

4. Processes and Structures for /NSs under the Stafford Act 

The NRP discusses the processes and structures for supporting an INS accompanied by a 
Stafford Act declaration. A Federal Coordinating Officer (FCO), appointed by the 
Secretary of Homeland Security on behalf of the President, manages and coordinates 
Federal resource support activities related to Stafford Act disasters and emergencies. The 
FCO works with the State Coordinating Officer (SCO) to identify requirements and 
approve requests. Both are located at the JFO. The JFO manages and coordinates requests 
through ESFs, which provide the mechanisms for Federal support to States, for declared 
disasters and emergencies. The State submits requests to the JFO via action request forms 
(ARFs). Once the FCO determines a request is eligible for Federal support (i.e., beyond 
the capacity of the State to provide), the JFO Operations Section crafts a Mission 
Assignment (MA) and forwards it to the appropriate ESF. The ESF then coordinates with 
the relevant Federal agencies and tasks them with the mission assignment. Figure III-l 
shows the basic ARF-MA process. 


Robert T. Stafford Disaster Relief and Emergency Assistance Act. 93 Pub. L. No. 288, 88 Stat. 143 
(1974) (codified as amended at 42 U.S.C. §§5121-5206. and scattered sections of 12 U.S.C., 16 U.S.C., 
20 U.S.C.. 26 U.S.C., 38 U.S.C. [20021). 
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Figure lll-l. Stafford Act ARF-MA Process 



5. Public Health Service Act 

The Secretary of HHS is authorized under the Public Health Service Act'*^ to declare a 
public health emergency. This declaration enables HHS to delegate its granted authority, 
release funds and resources to prevent the proliferation of a communicable disease, and 
plan an emergency medical response in the event of a disease outbreak. HHS is 
authorized to manage investigative and protective efforts, enter into contracts, assemble 
grants, disseminate information, and coordinate all other related actions reasonably 
necessary to respond to the emergency. The act gives HHS and its delegated authorities, 
such as the CDC and Food and Drug Administration (FDA), wide discretion and 
independence in the management of such efforts. 

A Federal declaration by HHS allows for the release of Federal resources, including 
money and manpower. However, unlike the Stafford Act, which has funding already 
appropriated for use in the event of a major disaster or emergency declaration, funds need 


“*42 U.S.C. 201.et seq. 
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to be appropriated ad hoc for use in a public health emergency/’ These funds should 
supplement, rather than supplant, other FSL public funds. 

HHS has no published detailed operational plan or burden-sharing agreement for 
coordinating a.ssistance with States or other Federal agencies during a public health 
emergency. Their CONORS does include some information on the process. The 
following statements are included in the HHS CONORS: 

• All requests for HHS assistance will be made to the Secretary through the 
Assistant Secretary for Fhiblic Health Emergency Rreparedness (ASRHER). 

• If HHS requires assistance from other Federal agencies, the ASRHER will make 
those requests on behalf of the Secretary. 

• On behalf of the Secretary, the ASRHER will provide specific MAs, priorities, 
and objectives to the Secretary’s Emergency Response Team (SERT). These MAs 
will be coordinated and may be made at the request of other Federal entities, 
particularly DHS. 

These statements lack sufficient detail on how requests will be submitted and coordinated 
with DHS and other Federal agencies. 

C. Reconstruction 

The Secretary of Homeland Security declared the events in New Jersey and Connecticut 
to be INSs on April 4 at 14:(X) and 16:00, respectively. 

The Governor of Connecticut asked the Rresident for a declaration under the Stafford Act 
at 15:00 on April 4, which was followed by a faxed written request. At 16:30, the 
Rresident verbally issued Stafford Act declarations for Connecticut and New Jersey. 

The Secretary of HHS declared a public health emergency in New Jersey at 17:30 on 
April 4. HHS requested assistance from other Federal agencies under the authorities 
granted by the Rublic Health Service Act. 

Once the Federal government declared the events in New Jersey to be an INS and an 
emergency under the Stafford Act, the expected Federal response organizations and 
processes became active. The FCO activated the ARF-MA process (see Figure III-l) and 
began coordinating the State's requests through ESFs."^^ Under the public health 
emergency in New Jersey. HHS requested direct support from other Federal agencies. 
HHS asked for Federal-to-Federal support from the Department of Veteran’s Affairs, 
DHS, and Department of Defense (DoD). Most of these requests went through the NRCC 
or went directly to Federal agencies with little State input or coordination with the JFO. 


■*’ U.S. Department of Health and Human Services, Concept of Operations Plan for Public Health and 
Medical Emergencies, March 2004. 

Refer to the section on “Re.source Reque.sts and Resource Coordination” for more information on the 
types of resources requested by the States and the channels through which they were processed. 
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D. Consequence 

In the T3 FSE, the terrorist attacks simulated in New Jersey and Connecticut resulted in 
the concurrent implementation of multiple Federal declarations to provide assistance to 
the States. The process for requesting and coordinating Federal-to-Federal support under 
a public health emergency in conjunction with a Stafford Act declaration was not 
understood. The guidance in the NRP was not sufficient to delineate the processes and 
responsibilities. Federal and State agencies had difficulty understanding how to 
coordinate resources and how to pay for them under the differing authorities and funding 
mechanisms. 

The T3 FSE revealed the following: 

• Neither the NRP nor the HHS CONOPS provides sufficient guidance for 
coordinating assistance for incidents that are concurrently covered under a 
Stafford Act declaration and a public health emergency. 

• HHS does not have a detailed process for requesting and coordinating Federal-to- 
Federal assistance for public health emergencies. 

• The funding capabilities of HHS and the funding responsibilities of States and 
other Federal agencies are unclear under a public health emergency. 

E. Analysis 

Data indicate that State and Federal agencies were uncertain about how to coordinate 
response efforts provided via the Public Health Service Act with those provided under the 
Stafford Act. Such uncertainty was due to the fact that the processes for requesting, 
tracking, and coordinating assistance provided by the Federal government under other 
Federal authorities in conjunction with a Stafford Act are unclear. This suggests that 
neither the NRP nor the HHS CONOPS provides sufficient guidance for coordinating 
Federal-to-Federal support under a public health emergency when a Stafford Act 
declaration is also in effect. Additionally, funding responsibilities for States under a 
public health emergency are unclear. 
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}. Insufficient NRP Guidance for Coordinating Assistance under a Stafford Act 
Declaration and a Public Health Emergency 

As discussed above, the NRP is intended to be the guiding document for INSs. The NRP 
describes the processes and structures for Stafford Act incidents and the processes for 
Federal-to-Federal support for INSs that are covered under other Federal authorities, such 
as a public health emergency. However, the NRP states that: 

In the context of Incidents of National Significance, these 
supplemental agency or interagency plans may implemented 
concurrently with the NRP. but are subordinated to the overarching 
core coordinating structures, processes, and protocols detailed in 
the NRP [emphasis added). In this case, the department or agency 
with primary responsibility for execution of the supplemental 
agency or interagency plan is also responsible for ensuring that all 
ongoing activities conform to the processes and protocols 
prescribed in the NRP. [emphasis added] 

Because the NRP describes structures, processes, and protocols for Stafford Act INSs and 
for INSs under other Federal authorities, the question is which of those are in effect 
during concurrent implementation of both Stafford Act and other Federal authorities. 

Figure 1II-2 shows the relationship among INSs, Stafford Act incidents, and incidents 
covered under other Federal authorities. In the case of incidents that are covered under 
the Stafford Act and other Federal authorities, the NRP .says little about how to request 
and coordinate Federal resources. 
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Figure III-2. Relationship Between INS and Incidents Covered Under Other Federal 
Authorities 


Covered in theNRP 



The NRP says: 


Federal departments and agencies supporting the NRP are 
activated and engaged using either a mission assignment process 
for events supported by Stafford Act funding or through 
interagency agreements or other direct funding sources when 
implemented using other authorities, (emphasis added 

The NRP does not specifically cover the case of an incident that is addressed 
concurrently by the Stafford Act and other Federal authorities. The NRP does not 
explicitly state that Stafford Act processes should be used for resources being requested 
under a public health emergency (or other Federal authorities) that is concurrent with a 
Stafford Act declaration. It also does not state that Federal agencies should submit 
requests for Federal-lo-Federal support through the JFO for a non-Stafford Act INS. The 
NRP simply calls for agencies to coordinate operations through the JFO, without 
sufficient detail as to how that coordination should occur. The HHS CONOPS also 
discusses coordination without detailing how it should be done. Both documents lack 
sufficient guidance for coordinating assistance for incidents covered concurrently under 
the Stafford Act and Public Health Service Act. 


National Response Plan (December 2(X)4). 
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2. Coordinating Federal-to-Federal Assistance Under a Public Health Emergency 

This lack of guidance in the NRP led to several problems with resource requests and 
coordination during The Stafford Act process is a bottom-up approach in which 
requests originate at the State and local levels, are coordinated at the JFO, and then are 
tasked to the appropriate Federal agency. To provide resources during the T3 FSE, HHS 
implemented a top-down approach that was not well defined or well understood by the 
response organizations. Consistent with its authorities under the Public Health Service 
Act. HHS requested support from other Federal agencies. Some requests were made 
directly to the other agencies, and some requests were submitted through the NRCC, 
which would then forward them to the appropriate Federal agency. For example, HHS 
submitted a request for a 10,000-bed alternative care facility to DHS through the NRCC, 
while requesting a 250-bed field hospital directly from DoD. 

Further complicating the process, HHS used the same top-down approach to provide 
resources in Connecticut, where a public health emergency had not been declared. For 
example, HHS requested a 250-bed alternative care facility and patient-movement assets 
for 1,000 patients directly from DoD and requested a 10,000-bed alternative care facility 
directly from DHS without coordinating with the State or JFO. 

In addition to using different paths for resource requests, HHS did not have an 
established process to coordinate its efforts with the JFO and the other Federal support 
being provided. States were often unaware of HHS requests until after they had been 
made. Lack of notification placed an unexpected logistical burden on the States. 

HHS lacked a clear process for coordinating Federal assistance under a public health 
emergency and did not follow the established Stafford Act process in Connecticut, where 
no public health emergency was declared. 

3. Funding Capabilities and Responsibilities Under a Public Health Emergency 

Under the Stafford Act. funds are set aside to pay for Federal assistance. The Stafford Act 
creates a cost-sharing agreement between the affected State and the Federal government, 
whereby the State is liable for up to 25 percent of the resource expenses. When a mission 
assignment is drafted, it includes the State’s burden share, so the SCO knows what the 
cost liability is prior to receiving Federal assistance. 

Under a public health emergency, HHS can authorize spending but has no funds set aside 
for such a purpose. A supplemental appropriation is needed to reimburse any funds spent 
in response to a public health emergency. Additionally, HHS has no process for burden 
sharing with States. As a result. States are uncertain of their cost responsibilities for 
support obtained under a public health emergency. 

During the T3 FSE, Federal and State agencies were uncertain about who would be 
paying for requests originating from HHS. The JFOs thought HHS should pay for the 

These problems are discussed in (he section on “Resource Requesting and Resource Coordination.” 
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medical support it was requesting under the public health emergency. Many Federal 
participants erroneously believed that funds were readily available to cover Federal 
assistance under the public health emergency. The States were uncertain as to what part 
of the costs they would incur. During a conference call on the morning of April 6, 
representatives from HHS, DoD, NRCC, RRCCs Region 1 and Region 2, CT JFO, and 
NJ JFO discussed who was requesting the 10,000-bed alternative care facility and the 
250-bed field hospital and who was going to pay for these resources. Connecticut did not 
want the 10,000-bed alternative care facility or the 250-bed field hospital if the State had 
to pay for it. They wanted assurance that HHS would incur the financial liability. HHS 
did not have a process in place to provide any information to the States on what would be 
their financial liability or what resources they would have to provide to support the 
Federal assets. 

Although HHS has spending authority under a public health emergency, no funds are set 
aside in advance. HHS and other Federal agencies have to use their own operating funds 
and/or request supplemental appropriations. State and local funding responsibilities under 
a public health emergency are unclear. During the T3 FSE, this resulted in hesitancy on 
the part of the States to accept any HHS-directed resources. 

4. Issues from Previous Exercises 

In the T2 FSE, no problems were noted with respect to the declaration of a public health 
emergency. In fact, the T2 After-Action Report (AAR) stated that “the declaration of the 
public health emergency in the Chicago area was enacted with little confusion or 
difficulty in execution.”' ' The primary difference between the two exercises was that 
during the T2 FSE, the NRP was not in effect. Additionally, HHS initially acted alone 
during the T2 FSE, because the public health emergency in Illinois was declared about 20 
hours before the Stafford Act declaration was made. The Stafford Act declaration was 
approved with only 20 hours remaining in the exercise (Table 111- 1 ). 


T2 Full-Scale Exercise After-Aclion Report, September 30, 2003, draft. 
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Table lll-l. Comparison ofT3 FSE with T2 FSE 


T2FSE 

T3 FSE 

SIGNIFICANT DECISIONS 

• After consulting with State officials and receiving 
confirmation of pneumonic plague, the Secretary of 

HHS declared a public health emergency in Illinois. 

The declaration came approximately 24 hours after the tirst 
disease clusters became apparent in the State. 

This declaration was made 20 hours before the Stafford Act 
declaration tor the State was made. 

• After a presumptive diagnosis of pneumonic plague, the 
Secretary of HHS declared a public health emergency In 
New Jersey. 

This declaration came approximately nine hours after the 
initial clusters of patients began presenting to NJ hospitals. 

A Stafford Act emergency declaration was issued shortly 
before the public health emergency declaration was made. 

ISSUES/OBSERVATIONS 

• No problems or difficulties with the public health 
emergency declaration were evident. 

However, it is not clear whether any entity actually tried to 
request resources through this act. 

Potential problems resulting from corKurrent implementation 
of a Stafford Act declaration and a Public Health Emergency 
Act declaration did not arise because of the timing of the 
declarations. 



• Neither the NRP nor the HHS CONORS provide sufficient 
guidance for coordinating assistance for Incidents that 
are concurrently covered under a Stafford Act 
declaration and a public health emergency. 

• HHS does not have a detailed process for requesting and 
coordinating FederaMo-Federal assistance for public 
health emergencies. 

• The funding capabilities of HHS and the funding 
responsibilities of States and other Federal agencies are 
unclear under a public health emergency. 


F. Recommendations 

• Clarify the process for Federal-to-Federal support for non-Stafford Act assistance 
in conjunction with a Stafford Act declaration. Determine whether the ARF-MA 
process can be used to request resources under other Federal authorities and how 
to coordinate those requests with the JFO. 

• Develop a transition plan for coordinating incidents that start under non-Stafford 
Act authorities but later grow to include a Stafford Act declaration. 

• Clarify the process for Federal-to-Federal support under a public health 
emergency. Include how HHS should coordinate with other Federal agencies, 
determine who is best suited for coordinating and tracking requests (e.g., HHS or 
FEMA), and determine what responsibilities other Federal agencies have to report 
to HHS. 

• Clarify the funding capabilities and responsibilities of States, HHS, and other 
Federal agencies under a public health emergency. 
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IV. The Strategic National Stockpile (SNS) and Points of Dispensing 
(PODs) — Task # III-8: Direct and Control Distribution of Supplies and 
Equipment 

A. Summary of Issue 

The issue is that the plan to conduct statewide prophylaxis evolved during the course of 
the exercise and did not appear to reflect a pre-planned and carefully integrated Federal 
and State response. It is not clear that the Federal government has a strategy or plan for 
implementing its own system of PODs or for rapidly identifying and supplying staff to 
support State efforts in the event of a large-scale requirement. 

The release of Yersinia pestis in New Jersey prompted State officials to request SNS 
support. The release also prompted Federal and State officials to notionally activate 
nearly 400 PODs throughout New Jersey for the purpose of providing prophylaxis to 
every resident of the State.^^ Analysis of T3 FSE data suggests that this plan was not 
executable. Distribution of prophylaxis to every State resident was complicated by the 
short incubation period of plague, a fragmented Federal-State planning process, and 
resource management issues. The announcement that 8.8 million residents had received 
prophylaxis during the exercise overlooks these issues and is based on other factors such 
as unrealistic POD throughput rates and activation timelines. Staffing was the primary 
resource constraint in successfully executing the proposed mass prophylaxis plan.*'^ To 
operate hundreds of notional PODs, officials had to identify and process thousands of 
workers. Observations made during the exercise indicate that such large numbers of 
workers are not presently available. 

Without the current capability to provide prophylaxis to every State resident, senior 
officials will have to focus on targeted prophylaxis (i.e., determining as quickly as 
possible the potentially exposed population). Under this scenario, the possibility exists 
that some residents who need prophylaxis may not receive it. The alternative is to 
develop an infrastructure (one component of which would include increasing the number 
of available and trained workers) that can support statewide prophylaxis: however, this 
approach could require a significant investment. 


The State announced a plan to supply prophylaxis within 48 hours to all residents of the State plus those 
who had worked in New Jersey since March 28. This announcement was made by the Governor’s office 
at 17:45 on April 5. 

Other constraints that potentially could have affected execution, such as transportation and parking, could 
not be examined. 
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Comparatively few problems were observed during the delivery and distribution of the 
SNS. There was some initial uncertainty about the SNS request, and there were problems 
integrating Federal plans for SNS deployment with the State; however, the T3 
participants successfully resolved these issues. Major observations from the exercise 
include: 

• New Jersey successfully received, broke down, and transported components of the 
SNS to PODs. 

• New Jersey set up and operated 22 real PODs using the guidelines of the New 
Jersey Mass Prophylaxis Manual and was able to assess issues of throughput, as 
well as setup and logistics. 

• In response to the outbreak of pneumonic plague. New Jersey attempted 
prophylaxis on a very large scale — effectively trying to reach 8+ million people 
under the very short epidemiological time frame associated with the disease. The 
State opened and operated an additional 200 notional PODs. 

• The Federal government established its own system of PODs — opening more than 
160 notional sites at postal facilities. Veterans Affairs (VA) hospitals, and Health 
Resources and Services Administration (HRSA) community centers. This action 
was meant to support the rapid expansion of prophylaxis undertaken by the State, 
but also appeared to reflect Federal government efforts to gel out in front of the 
developing epidemic. 

• The Federal government did not appear to consider at least one of the approaches 
being considered in the HHS Cities Readiness Initiative (CRl) — i.e., delivering 
medicine to people instead of having people come to the medicine — but instead 
relied entirely on fixed PODs. 

B. Background 

I. SNS 

The SNS is an extensive inventory of medical supplies (e.g., antibiotics, vaccines, 
bandages, and ventilators) configured for rapid deployment in response to a potential or 
actual mass casualty event. The SNS is managed by the CDC for the DHS. 

The SNS is divided into two components: push packs and managed inventory. Each of 
the 12 push packs contains a wide range of medical supplies designed to meet a variety of 
scenarios. The push packs contain approximately 50 tons of medical supplies and are 
staged at transportation hubs throughout the United States. In response to a mass casualty 
event, the CDC can deploy a push pack to an affected area within 12 hours of the request. 
If additional medical supplies are required, the CDC can deploy additional push packs or 
ship managed inventory within 24 to 36 hours. Managed inventory refers to large 
stockpiles of medical supplies that can be used to augment the contents of the push packs. 
Instead of deploying additional push packs that may contain supplies that are not needed, 
the CDC uses the managed inventory to meet the specific medical needs of an affected 
area. 
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For example, the CDC could respond to a State request for SNS support during an 
anthrax outbreak by deploying a push pack, because push packs can be delivered rapidly 
and contain the antibiotics needed to treat the infection. If the contents of the deployed 
push pack were not sufficient to meet the needs of the affected population, the CDC 
could use managed inventory. The managed inventory would arrive later, but the 
shipment would contain large quantities of the medical items needed to treat anthrax 
victims (e.g., antibiotics and ventilators). In this example where the medical needs are 
clear, turning to managed inventory would be preferable to deploying additional push 
packs, because the latter contain many items that are not typically used to treat anthrax 
infections (e.g., bandages and splints). Unlike the prepackaged push packs, shipments of 
managed inventory can be configured to meet the specific medical needs of the affected 
population. 

The Technical Advisory Response Unit (TARU) accompanies SNS deployments and 
provides guidance on its use. The TARU consists of subject-matter experts (e.g., 
logisticians and emergency responders) familiar with the contents of the SNS and 
procedures that govern its employment. For example, the TARU has exercised the 
distribution of SNS medications to PODs and can provide details of the push pack 
contents. 

2. PODs 

Health officials can use PODs to rapidly distribute medical supplies from the SNS to 
large numbers of potentially exposed but asymptomatic people. During a public health 
emergency, people can be directed to a local POD where health care professionals would 
screen them to determine if the medication is appropriate and safe for them to take. If 
prophylaxis is warranted, individuals receive the medication or vaccine that will prevent 
them from becoming ill. 

The total number of people who can receive prophylaxis is a function of three factors: 
length of time the PODs are active, throughput rate, and the number of active PODs. The 
window of opportunity for distributing prophylaxis to an affected population begins when 
the disease and the potentially exposed population have been identified and ends when 
people living in the hazard areas are no longer likely to contract the disease. Other 
considerations of great importance not examined in this exercise include such issues as 
transportation access to the POD and available parking. 

Throughput rate refers to the number of patients that a POD can process in a fixed period 
of time (typically about an hour). This rate can be affected by the size of the staff and the 
standard of care provided by the staff. A larger staff will support a higher hourly 
throughput rate (if the physical space is large enough); however, locating large numbers 
of medical, security, and support staff on short notice during a public health emergency is 
challenging. “Standard of care” refers to the services provided at the POD. 
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Whereas the minimum standard of care service would be to simply distribute medication 
to patients, the NJ plan, like others, prescribes a higher standard of care that includes: 

• education about the disease (e.g., plague) and the antibiotics (e.g., doxycycline); 

• medical assessment to identify those requiring additional treatment; 

• transportation of symptomatic patients to a hospital; 

• translation services; 

• medical screening to identify people for whom the treatment is contraindicated 
(e.g., a person who is allergic to antibiotics); and 

• mental health counseling. 

Increasing the standard of care without implementing corresponding increases in staffing 
and logistical support will reduce the throughput rate and increase the required logistical 
support. Each service requires additional staff, a larger physical space, and additional 
materials (e.g., forms, masks, and rubber gloves), and it increases patient time in the 
POD. Patients remaining for longer periods of time may create backlogs inside the 
facility and traffic jams outside, further reducing the throughput rate. 

Increasing the number of PODs can increase overall throughput, but doing so would 
create additional logistical challenges. Each POD would need to have an identified site 
and would have to be supplied, secured, publicized, and staffed. Each of these steps 
would have to be completed before prophylaxis distribution could begin. 

In preparation for the T3 FSE, the NJ DHSS developed the New Jersey Mass Prophylaxis 
Manual. In this document. NJ DHSS highlights key elements of its mass prophylaxis 
plan, including the following: 

• PODs will be supplied with FSL supplies. 

• A mass prophylaxis effort will require several types of workers, including nurses, 
pharmacists, counselors, security, translators, administrators, and support 
personnel. 

• PODs that distribute oral medication require a staff of 183 personnel for each 
eight-hour shift. 

• POD throughput rates will be 1 ,000 people per hour for oral prophylaxis. 

• It is recommended that PODs operate 16 hours per day (24-hour operations are 
possible). 

• The standard of care in New Jersey will include an education and screening 
process to identify individuals who should receive the prophylaxis and those who 
are contraindicated. 
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During the T3 FSE, New Jersey planned to activate 22 real PODs throughout the State. 
One POD would be activated in each of the following counties and municipalities; 


Atlantic County 
Bergen County 
Burlington County 
Camden County 
Cape May County 
City of Newark 
City of Paterson 
Cumberland/Salem Counties 


Essex County 
Gloucester County 
Hudson County 
Hunterdon County 
Mercer County 
Middlesex County 
Monmouth County 
Morris County 


Ocean County 
Passaic County 
Somerset County 
Sussex County 
Union County 
Warren County 


As part of the exercise, each of these 22 PODs was scheduled to operate for 
approximately four hours during one day of the exercise. During these hours of operation, 
the PODs would function as they would during a real public health emergency. Law 
enforcement officers would provide security, and staff would process volunteers 
simulating patients. Notionally, these 22 PODs could operate throughout the duration of 
the public health emergency and additional PODs could be opened as needed. 
Representatives from the NJ DHSS indicated that, in an actual event, the State could 
operate a maximum of five PODs per county for a statewide total of approximately 100. 

C. Reconstruction 

The release of Yersinia pestis in New Jersey prompted a request to the Federal 
government for the SNS and eventually the decision to activate a large number of PODs 
throughout the State. Figure IV- 1 depicts the sequence of activities discussed in this 
section. 
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Figure IV-1. Timeline of NJ SNS and POD Activities 
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As part of the exercise scenario, terrorists notionally released the bacteria along sections 
of the Garden State Parkway, U.S. Route 1, and NJ Route 18 in northern New Jersey 
during the early morning hours of April 2. The release began at 02:00 on April 2 and 
ended shortly thereafter. Approximately 24 hours later on the morning of April 3. the first 
patient presented at a local hospital complaining of “flu-like” symptoms. 

During the day on Monday. April 4. evidence began accumulating that New Jersey was 
facing a public health emergency cau.sed by the deliberate release of a biological agent. 
At 10:20 on April 4. hospital officials notified the NJ DHSS that they had patients with 
symptoms consistent with plague. A presumptive diagnosis of plague was made based 
upon initial lab tests of patient samples. In response to this information, the NJ Governor 
requested the SNS from the CDC and ordered the activation of PODs throughout New 
Jersey. Despite some initial uncertainty about the request, the Secretary of HHS 
authorized the deployment of the SNS to New Jersey at 15:15. 

The first SNS shipments, the managed inventory, arrived at the NJ State receipt, stage, 
and .store (RSS) site at approximately 21:30 on April 4. The .second SNS shipment, the 
push pack, arrived approximately five hours later. The two shipments contained a total 
of 10 million courses of treatment (primarily of doxycycline). Overnight, the RSS staff 


During a real emergency, push packs are more likely lo arrive firsU however, an exercise artificiality 
caused the managed inventory to arrive before the T3 push pack. 
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and TARU team began preparing the SNS shipments for distribution to the county RSS 
site and PODs. 

POD operations involved both real and notional sites. The first real POD opened in 
Union County at 12:00 on April 5. Additional real PODs opened on the following days, 
and each operated for several hours. During the day on April 5, NJ officials began 
planning to greatly expand the number of distribution sites in the State. At 17:45 on April 
5, the NJ Governor announced that the State had decided to distribute prophylaxis to all 
residents and those who had worked in the State. Initially, the Governor announced that 
New Jersey would open 456 more notional PODs (400 at high schools and 56 at 
colleges). This number was subsequently reduced to approximately 200 notional PODs 
later in the planning process. These notional sites were reportedly operational at 08:00 on 
April 6. 

To augment the State’s efforts, the Federal government decided to open a large number 
(more than 160) of notional PODs in the four hardest hit counties: Middlesex, Union, 
Hudson, and Essex. These PODs would be located at U.S. Postal Service (USPS) 
facilities, VA hospitals, and HRSA Community Centers. In a series of conference calls 
during the night of April 5, NJ, FEMA, and HHS representatives discussed the Federal 
plan. HHS indicated that Federal PODs would begin operations by 08:00 on April 6; all 
were reported open four hours later at 12:00. The Federal PODs would be under the 
direction of the NJ PFO and would be staffed by USPS volunteers and other personnel 
provided by the Federal government. State and Federal sites operated continuously until 
they closed, with the Federal sites closing at 12:00 on April 7 and the State sites closing 
1 1 hours later. At that time, officials announced that all 8.8 million residents had received 
prophylaxis. 

D. Consequence 

The T3 experience highlights the dilemma that decision makers may face when dealing 
with the deliberate release of a biological agent on a large scale. In real-world public 
health emergencies, as in the exercise, political leaders will have to choose between 
focused or widespread distribution of prophylaxis. Both policies carry risks for these 
leaders. A more focused, or targeted, approach is less resource intensive, but requires 
accurate determination of the potentially exposed population and a carefully crafted 
public message. It carries the risk that some individuals who need prophylaxis may not 
receive it, but it exposes fewer people to potentially adverse effects. A much wider-scale 
effort, like the one attempted in New Jersey, may encounter logistical and resource 
limitations that constrain the number of PODs the State can operate, increase the time it 
takes to distribute prophylaxis, expose a higher number of people to the potentially 
adverse effects of antibiotic treatment, and possibly leave some residents in the most 
affected area without prophylaxis. The T3 FSE experience highlighted the difficulties of 
not having the planning and resources at the Federal and State levels to rapidly execute a 
large-scale prophylaxis plan. 
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E. Analysis 

The T3 FSE exercised both the deployment of the SNS, as well as the POD setup and 
distribution processes. Relatively few issues were noted during the delivery and 
distribution of the SNS; however, the exercise did highlight significant issues with the 
decision to provide prophylaxis to all of the residents of New Jersey. 

1. SNS 

At 15:00 on April 4. the Governor of New Jersey made a public statement in which he 
requested deployment of the SNS. However, this verbal request was not immediately 
followed up with a written request from the State to the CDC.^^ The first indication of a 
formal request from New Jersey did not appear until several hours later at 18:30. The lack 
of supporting documentation appeared to create ambiguity about the request. State and 
Federal officials were not certain if the State had actually requested the SNS or how the 
CDC would react to a verbal request without supporting documentation. In the exercise, 
the CDC deployed managed inventory to New Jersey prior to a formal request at the 
direction of the Secretary of Health and Human Services. . 

Observations made during the deployment of the SNS indicate that State officials were 
not fully integrated into the planning efforts and had to react to deployment decisions 
made by Federal officials. For example. State officials were not aware of the arrival of 
the TARU or the requirement to transport the unit to the RSS site until shortly before the 
TARU arrived in New Jersey. In addition, the arrival times of the managed inventory and 
push pack changed with little notice. NJ planners successfully reacted by rescheduling 
escorts and RSS staffing to accommodate the changes. Despite these disconnects, the 
deployment proceeded because State officials were able to replan and reschedule the 
State’s support for deployment of the Federal asset. 

2. PODs 

The plan to distribute prophylaxis to every resident in the State was complicated by the 
short incubation period of plague, a fragmented Federal-State planning process, and 
resource management issues. These observations indicate that the plan to distribute 
prophylaxis to the entire population of New Jersey was not executable. 

a. Time: A Limiting Factor 

Most individuals exposed to an aerosolized release of Yersinia pestis will become 
symptomatic within one to six days.^* This provides a theoretical window of five days or 


The governor’s comments were made under the assumption that the press conference would be taped and 
broadcast later in the day. 

The exact timeline depends in part on the dose an individual receives and the physical condition of that 
individual. 
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fewer to provide antibiotics to exposed individuals.^^ This window of opportunity is 
reduced by the time it takes to determine that the initial cases are actually plague and that 
the infection is a public health threat rather than an isolated case. The time available to 
distribute prophylaxis is further reduced by the need to request and receive the SNS and 
execute the State/local prophylaxis plan. These factors may reduce available time for 
distribution to less than three days. 

Figure lV-1 depicts the timeline of the NJ response. Some of these times were affected by 
exercise artificialities and would vary from event to event. For example, the length of 
time between the first patient arriving at a hospital and the request for SNS could be 
affected by many factors, including the following: 

• length of time the patient has to wait to be seen by a physician; 

• diagnostic skills of the physician; 

• workload of hospital and State labs; 

• level of suspicion of health care providers and public health personnel; 

• speed with which State health officials determine that the initial case is not an 
aberration; and 

• State leadership’s familiarity with the SNS process. 

The timing observed in the T3 FSE was artificial, becau.se participants were aware of the 
exercise and many knew that pneumonic plague was the disease. Observation of the 
timeline in Figure IV- 1 suggests that the first notional PODs could have opened at 
approximately 08:00 on April 5, leaving a total of 66 hours (08:00 on April 5 through 
02:00 on April 8 when most originally exposed individuals would have become 
symptomatic) to distribute prophylaxis to 8.8 million residents. As the exercise evolved, 
the stated goal was to complete the distribution by 23:00 on April 7. 

b. Fragmented Federal and State Planning 

Over the course of the exercise, two separate POD systems developed: State and Federal. 
At times, the existence of the two systems created confusion among the participants, 
possibly reducing the effectiveness of the plan to physically exercise 22 PODs while 
planning for the activation of additional notional PODs resulting from player action.. 

As the scope of the public health emergency in New Jersey widened, NJ officials became 
aware that HHS and DHS were concerned that the State plan to distribute prophylaxis 
would not cover enough residents. In discussions with the PFO cell, the NJ DHSS 
reported that New Jersey could operate as many as five PODs per county if conditions 
warranted that number: however. New Jersey officials felt that the number of victims as 
of April 5 at most warranted two to three PODs per county. 


This timeline assumes that the detection of the release occurs because sick patients arrive at hospitals, 
rather because the terrorists releasing the pathogen are caught. 
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Officials from HHS and DHS preferred a more aggressive prophylaxis program and 
began the process of establishing PODs at Federal facilities in New Jersey. HHS planned 
to supplement New Jersey’s prophylaxis plan by opening more than 160 notional PODs. 
The Federal goal was to distribute prophylaxis to 2.8 million individuals in the four most 
affected counties. 

In response to the Federal government’s concerns and the growing number of plague 
victims, the NJ Governor announced a plan to expand the distribution of prophylaxis to 
include every resident and everyone who visited the State during a specific period of 
time. During the afternoon of April 5, New Jersey began executing plans to increase the 
number of PODs to 478 (i.e., 22 real and 456 notional ones). The number of notional 
State PODs was subsequently reduced to approximately 200. These additional State sites 
would operate under the guidelines of the New Jersey Mass Prophylaxis Manual and 
would be staffed by a mix of State personnel and personnel provided by the Federal 
government. 

Federal and State prophylaxis efforts were not closely coordinated. Implementation of the 
Federal plan surprised many State officials. Likewise, the State decision to activate 
additional PODs did not appear to have an observable impact on Federal planning. State 
and Federal officials also disagreed on standards of care and staffing levels. NJ officials 
insisted that distribution sites follow the New Jersey Mass Prophylaxis Manual, which 
provided a higher standard of care (e.g.. education, screening, and counseling) and 
required a larger staff (i.e., 183 personnel per shift) than the Federal plan for New Jersey. 
Federal officials opted for a lower standard of care (i.e., literature and medication 
distribution, rather than personal screening) and a smaller staff (i.e., as few as 10 per 
shift). When Federal and State officials reached an impasse. Federal officials indicated 
that they would operate the Federal system separately. 

Additionally there is no plan in place to deliver medical supplies to Federally operated 
PODs. The State’s Receipt, Store and Stage (RSS) site did not have the capability to 
handle the volume of medical material required to supply both the State and Federal 
operated PODs. nor did they have the transportation assets to deliver the material. To 
supply the Federally operated PODs with prophylaxis would have required a sufficiently 
equipped and staffed warehouse, adequate trucks and drivers and a logistics management 
system to maintain the supply chain. 

With two systems operating, reliable information about either one was difficult to obtain. 
Many NJ officials were unaware of the Federal sites until after they began operations. For 
example, the State Epidemiologist stated on VNN that 46 PODs were open at 09:33 on 
April 6. Moments later, a NJ DHSS Deputy Commissioner, also being interviewed on 
VNN, stated that 40 were operational. According to the Federal plan, the 163 Federal 
sites were beginning operations during these two interviews. 
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c. Inconsistency in the Reported Number of PODs 


Planning issues extended beyond sharing information about the operation of the two 
systems. Among the State and Federal participants, there was little consistency on a 
basic, but essential fact — the number of PODs operating in New Jersey. The timeline 
described in Table IV- 1 provides insights into this issue. 
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Table IV-I. Insights into the Level of POD Awareness Among Participants 


Date 

Time 

Event 

April 5 

16:52 

NJ PFO is notified that the State will activate 456 additional PODs (at 400 
high schools and 56 colleges) for a total of 478 PODs. 

April 5 

18:46 

Governor's Office announced that New Jersey has taken control of 400 high 
schools and 56 colleges to be used as PODs. They open by April 6 at 08:00. 

April 5 

21:30 

In a POD planning teleconference call that brought together RRCC, NJ 

Public Health, NJ Office of Emergency Management (OEM). HHS, PFO, 
DoD, and the Governor’s Office, it was announced that the postal PODs 
would begin opening at 08:00. All 163 would be open by noon on April 6. 
New Jersey announced an increase in the number of PODs from 22 to 104. 

April 5 

23:00 

HHS announced its plan to augment the 200 State PODs with 163 Federal 
PODs. 

April 6 

09:33 

VNN report: The Slate Epidemiologist stated that 46 PODs were open. 

April 6 

09:45 

VNN report: Deputy Commissioner Blumenstock (NJ DHSS) reported that 

40 PODs are operational. 

April 6 

14:50 

NJ EOC shift-change brief notes that there are 160 PODs operating in 

Essex, Union, Middle.sex, and Hudson counties. 

April 6 

15:15 

According to the NJ PFO. there are currently 280 PODs active in New 

Jersey. 

April 6 

16:30 

SERT announces that 300 PODs are active in New Jersey. 

April 6 

18:57 

Displays in the Emergency Respon.se Team - Advance Element (ERT-A) 
indicate that there are 285 active PODs in New Jersey, including 163 USPS 
sites. 

April 6 

21:15 

NJ DHSS states that, as of 18:30 on April 6. 456 State and Federal PODs 
were operating (21 1 at high schools. 56 at colleges, and 189 by HHS). 

April 6 

21:30 

The NJ State Police-OEM situation report (SITREP) #12 stated that 456 

PODs are active in New Jersey. 

April 7 

08:30 

State EOC briefing noted that 129 USPS PODs are active. 

April 7 

10:15 

Briefing from the Governor’s Office indicated that 267 (211 high schools 
and 56 colleges) and 1 89 Federal PODs are active. 

April 7 

10:40 

Health Command Center (HCC) reports that the following PODs were open: 
163 post offices, 7 VA hospitals, 19 HRSA community health centers, 20 
community Local Information Network and Communications System 
(LINCS) (Federal total = 209). A total of 248 State PODs were open. 

April 7 

10:58 

OEM and Governor’s Office are using the following POD figures: 1 89 

Federal and 267 State (from NJ Health Operations Tracking System 
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Date 

Time 

Event 



[HOTS) log). 

April 7 

12:00 

All Federal PODs were demobilized (other reports indicate that the Federal 
PODs closed at 02:00 on April 7). 

April 7 

14:00 

HCC list of active PODs included; 248 schools, 163 post offices, 7 VA 
hospitals, and 19 HRSA community health centers (total = 437). 

April 7 

18:30 

NJ governor’s office reported that New Jersey had opened PODs at 21 1 
high schools and 56 colleges. HHS had opened 189 PODs at post offices 
(total = 456). 

April 7 

19:30 

Defense Coordinating Officer (DCO) brief at the JFO reported that 248 

State and 189 Federal PODs were active. 


Table IV- 1 clearly indicates that uncertainty about the number of active PODs was 
common and widespread. This inconsistency suggests that the planning process was 
incomplete and that information about the two systems was not being shared among 
Federal and State agencies. For example, representatives from the JFO were unable locate 
the list of State PODs. In addition to the evidence in Table IV-I, there are no indications 
that a complete list of PODs existed. The list assembled by the NJ State HOC contained 
the location of 124 post offices and 456 State PODs operating at NJ high schools and 
colleges. However, it omitted the 22 real PODs and 39 notional PODs (13 post offices, 19 
HRSA facilities, and 7 VA hospitals). Ready access to accurate information from such a 
list is critical to the response, because this information would be used to inform SNS 
delivery staff, POD workers, and residents on where to go. 

d. Management of Staff Resources 

The POD plan developed during the exercise was incomplete and did not address the 
staffing needs required to provide prophylaxis to every State resident. Officials in New 
Jersey did not establish a staffing requirement or develop a mechanism for integrating the 
additional workers into the two POD systems. Without these elements. Federal and State 
officials could not develop an executable plan for the two systems. In many respects, 
these problems reflect problems associated with attempting to carry out this scale of 
prophylaxis for the first time right in the middle of the public health emergency. 

Uncertainty about the number of workers per shift and the number of PODs needing to be 
staffed frustrated efforts to define the staffing requirement. Estimates of the number of 
personnel varied from 10 per shift at the USPS PODs to 183 per shift as prescribed in the 
New Jersey Mass Prophylaxis Manual. Without an agreement on the staffing levels at the 
PODs or the number needing to be staffed, it was difficult to establish a requirement or 
track progress made toward staffing them. 

The existence of State and Federal systems created additional problems for those 
responsible for staffing the PODs. When officials would identify a group of medical 
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professionals or security personnel staff, it was sometimes unclear whether these 
resources would be used to staff Federal locations, State locations, or both. The State 
submitted one ARF in which the State EOC requested security personnel for both State 
and Federal PODs. Table IV-2 documents the ad hoc search for workers that occurred 
during the exercise. 

Table IV-2. Uncertainty Surrounding the Staffing of NJ PODs 


Date I Time 




Event 


HHS is looking into a memorandum of understanding (MOU) with the USPS 
about delivering medications. HHS indicated that 3,300 health care workers are 
available. HHS determines USPS MOU is not feasible. 


ESF-8 directs SERT and DoD to provide all available personnel to staff PODs 
with VA. DoD, DHS, National Disaster Medical System (NDMS), and Medical 
Reserve Corps (MRC). The requirement is to provide 15,000 personnel. 


In a teleconference between State officials and HHS. HHS indicates that it has 
1 ,400 personnel ready to staff PODs (five public health officers per shift to 
support USPS stafO- 


NJ officials state that I5,0(X) POD workers will be trained Wednesday morning 
(April 6) and then be assigned to PODs. 


The FEMA ERT-A is trying to arrange security for 400 NJ PODs. 


At the morning brief, the ERT-A Ops chief. FCO. and SCO note that 163 Federal 
PODs will be open today and staffed by the MRC. 


The RRCC reports that Federal PODs are almost completely staffed, and the 
Federal Protective Service is providing security (potentially augmented by NJ 
National Guard). 


In an e-mail, the IlMG and DHS staffs were observed attempting to resolve 
confusion over which organization (e.g.. Federal Protective Service, NJ National 
Guard, or U.S. Postal Inspectors) would provide security at the Federal PODs. 


FEMA has received an official request from New Jersey for 4,(H){) POD security 
personnel and 200 POD logistic elements. 


TTiere is a request to provide 2,000 POD workers from the American Red Cross. 


There is an ARF for armed security at the PODs. The ARF is a request to provide 
10 armed security personnel per Federal POD, for a total of 1,680. 


In a LINCS e-mail. NJ DHSS states that staffing at the State PODs included 
school nurses, NJ National Guard (three to four soldiers per shift). Emergency 
Management Assistance Compact (EMAC) from 20 States, 1 5,000 State workers, 
local law enforcement, and 4,200 community emergency response team members. 


The NJ State Police-OEM SITREP #12 states that Oklahoma will send two 16- 
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Date 

Time 

Event 



person teams to assist PODs with distribution of pharmaceuticals. 



The FEMA Emergency Services Branch Chief is in contact with NJ State Police 
to backfill 4,000 officers for POD security. 



NJ National Guard needs clarification on a request to provide security to 248 

PODs. 



An MA from FEMA to DoD to provide POD medical personnel is pending. 



The NJ Department of Military and Veterans Affairs (DMAVA) informs the State 
EOC that it will assign four soldiers on two shifts to provide security at the 

State’s 267 PODs. 



HHS plans to release 1,200 Public Health Service staff from supporting PODs 
and use them to help fulfill the NJ request for 12,0(K) health care profe.s-sionals. 



Federal POD prophylaxis has been completed. The personnel (1,200 U.S. Public 
Health Commissioned Corps and 3.000 MRC) were reassigned to State PODs, 



ARF 20 (requesting 4.000 law enforcement officers for POD security) is still 
being worked by JFO Emergency Services. 


The impromptu nature of the staffing process highlighted in Table IV-2 illustrates the 
difficulty of staffing hundreds of PODs with thousands of workers within a short period 
of time without the benefit of a detailed pre-incident Federal-State plan covering this 
possibility. 

The data also suggest that State and Federal officials were still identifying staffing 
sources (e.g., American Red Cross, MRC, and NJ National Guard) on the last full day of 
the exercise. For example, the Federal Protective Services (FPS), which was responsible 
for coordinating security forces for ESF #13, received confirmation of a NJ request for 
4,000 security personnel to support operations at 1 1:50 on April 7(11 hours before the 
State PODs were scheduled to close). It is unlikely that the FPS could have processed 
such a request and provided the requested level of support by the time that all State PODs 
would have closed. 

The conclusion that statewide prophylaxis was completed by midnight on April 7 is 
based upon the operation of a large number of notional PODs; however, the data in Table 
lV-2 indicate that an executable staffing plan for these PODs had not been developed by 
this deadline. Even if a staffing requirement had been established and a mechanism to 
integrate Federal and State resources was available, the lack of readily available workers 
would have adversely affected activation timelines and throughput rates. 

Theoretically, it was possible to meet the stated goal of distributing prophylaxis to every 
NJ resident by 23:00 on April 8. Table IV-3 summarizes the potential throughput of the 
NJ PODs during the exercise. 
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Table IV-3. Notional Statewide Prophylaxis 


PODs 

Maximum Hours of Operation 

Assumed 
Throughput 
(per Hour) 

Total 

Throughput 

(Notional) 


End 

Hours 

State PODs 






22 Planned PODs 

()8;{)0 Apr. 5 

24:00 Apr. 7 

64 

1,(X)0 

1.4 million 

200 High 

Schools/Colleges 

08:00 Apr. 6 

24:00 Apr. 7 

40 

1,000 

8.0 million 

Federal PODs 






1 37 Post Offices 

08:00 Apr. 6 

12:00 Apr. 7 

28 

750 

2.9 million 

19 HRS A Centers 

08:00 Apr. 6 

12:00 Apr. 7 

28 

1,000 

,5 million 

7 VA Hospitals 

08:00 Apr. 6 

12:00 Apr. 7 

28 

1,000 

.2 million 

Notional Total 





13.0 million 


Table IV-3 indicates that the plan adopted by New Jersey and the Federal government 
made it theoretically possible to process 13 million residents through the State and 
Federal POD systems. This outcome would have depended upon the rapid activation of 
POD sites and throughputs of 750 (at USPS sites) and 1,000 (at all other PODs) people 
per hour among numerous factors. 

Activation timelines depicted in Table IV-3 were unrealistic. The personnel needed to 
staff the 385 PODs had not been identified by the end of the exercise; therefore, they 
could not all have opened by the stated times. To meet the stated timelines, both the State 
and Federal POD activation processes had to be completed less than 18 hours from the 
point at which the decision to open the sites was made. Activation requires site 
preparation, staffing, delivery of supplies, and public notification. The staffing process 
includes identifying, notifying, and transporting qualified personnel. As noted earlier, the 
necessary workers were not in place when PODs were scheduled to open. Some Federal 
resources, such as the MRC, may not be currently available. 

The New Jersey Mass Prophylaxis Manual states that a staff of 183 is required to process 

1.000 people per hour (the plan also assumes an eight-hour shift). Using this standard, 
State and Federal planners would have to identify, notify, and transport more than 

210.000 workers to operate the 385 PODs 24 hours per day.^ Operating them with only 


The actual number of Stale PODs was never definitively establi.shed. Available data suggest that 
approximately 222 (200 notional and 22 real) State PODs were activated. 

The li.st of PODs provided by the NJ State ECXT contained 124 POD postal facililie.s; however, the 
numbers used in this table were widely cited during the exercise. 

^This also assumes that the right mix of skills is present and that the staff has been properly trained. 
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10% of the planned staffs {e.g., 27 staff members per 12-hour shift) would have required 
approximately 21,000 workers. It is not clear that the Federal and State governments 
could have even met the 10 percent threshold. 

Identifying sources of staffing is just the first step in a process that could take several 
days. After identifying the source, the organizations have to be tasked and the workers 
have to be notified. Once notified, the workers may have to travel significant distances. 
For example, workers from EMAC were drawn from 20 States. These observations 
suggest that many of the notional PODs did not have the required .staffs and could not 
have opened. Many of those that could open would have been minimally staffed. These 
understaffed PODs would have been unlikely to process 1,000 POD visitors per hour. 

e. POD Throughput Rates Lower than Target Goals 

Observations made during the exercise at the 22 real PODs suggest that the target 
throughput rate of 1,000 people per hour greatly overestimated the actual rate. Table IV-4 
summarizes the throughput observations made during the exercise by data collectors 
assigned to these PODs. In some instances, the data collectors counted the number of 
patients processed.*’' They also noted numerous instances in which “bottlenecks” and 
“backups” slowed the processing of POD patients. 


Table IV-4. T3 FSE POD Throughput Observations 


Locale 

Hours of 
Operation 

Total 

Throughput 

Hourly 

Throughput 

Data Collector Observations 
on POD Throughput 

Atlantic 

3.0 

935 

311 

■'Overwhelmed,” "jammed-up," and 
"very backed-up" 

Bergen 

2.5 

No data 

No data 

No comments 

Burlington 

1.0 

No data 

No data 

"IThe POD is] ... too small for .500 
patients per hour." 

Camden 

2.5 

282 

113 

No comments 

Cape May 

3.0 


300 

“Long lines" and “stalling" 

Cumberland/ 

Salem 

3.0 

784* 

261* 

“Backing up" 

Essex 

3.5 

No data 

No data 

"Long lines," “backing up.” 

"excessive numbers in line,” and 
“little movement” 

Gloucester 

3.0 

388* 


“Long lines,” “backup,” and “backlog 
of more than 50" 

Hudson 

2.5 

1.949* 

780* 

"Huge bottlenecks” and “backlog" 

Hunterdon 

4.5 

No data 

No data 

“Backing up” and “bottleneck" 


Data about the staffing levels at the PODs were not available. 
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Locale 

Hours of 
Operation 

Total 

Throughput 

Hourly 

Throughput 

Data Collector Observations 
on POD Throughput 

Mercer 

4.5 

545* 

121* 

"Long lines,” “back-upped,” 
“overwhelmed,” and “much 
confusion" 

Middlesex 

3.0 

420 

140 

No comments 

Monmouth 


No data 

No data 

No comments 

Morris 

2.0 

No data 

No data 

No comments 

Newark 

4.5 

655 

146 

■•Bottleneck” 

Ocean 

2.0 

No data 

No data 

“Congestion" and “backup” 

Passaic 

1.0+ 

No data 

No data 

No comments 

Paterson*^ 

2.0 

120 

60 

“Confusion” and “problems” 

Somerset 

2.5 

No data 

No data 

“Backlog” 

Sussex 

2.5 

No data 

No data 

“Overwhelmed” and ‘■backcd-up" 

Union 

3.0 

1,223* 

408* 

"Backlog" and “backing up" 

“Patient flow slowed to nonexistent.” 

Warren 

2.5 

No data 

No data 

“Backup” and "bottleneck” 


* These numbers indicate the patients that received medication. Some individuals would have been sent 
home without medication or sent to a hospital for treatment. 


Throughputs observed at the PODs were significantly lower than the planning factor of 
1,000 people per hour that was used to model prophylaxis progress in the exercise. 
However, the rates observed in the T3 FSE are not inconsistent with throughputs 
observed at exercises designed to test throughput at a POD. An exercise in which 
residents of Washington, D.C., were exposed to the plague found that a POD staff of 57 
(not including security) could process (i.e., screen patients and distribute antibiotics) 
approximately 1 1 1 patients per hour.^’ In April 2003, Arlington County, VA, in 
conjunction with HHS, tested the CDC model smallpox mass vaccination clinic and 
found that a staff of 47 (not including security) could process approximately 104 patients 
per hour.^ The results from these studies and others,^^ as well as the observations, 


Paterson POD experienced a real-world bomb scare during exercise play which may have affected 
throughput numbers 

Monica Giovachino, Thomas Calhoun, Neil Carey. Briant Coleman, Gabriella Gonzalez, Bernard 
Hardeman, Brian McCue. Optimizing a District of Columbia Strategic National Stockpile Dispensing 
Center. Journal of Public Health Management and Practice, 2005, 1 1(4), 282-290. 

” Brian G. McCue and Monica J. Giovachino, A Field Test of the CDC Smallpox Vaccination Clinic 
Model. The CNA Corporation. IPR 10847, April 2003. 

See additional studies cited in Brian G. McCue and Monica J. Giovachino. A Field Test of the CDC 
Smallpox Vaccination Clinic Model, The CNA Corporation, IPR 10847, April 2003. 
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indicate that the planning throughput of 1 ,000 people per hour probably overestimates the 
number that could be processed. 

f. Weighing Trade-offs When Making Prophylaxis Decisions 

During the exercise, the decision was eventually made to distribute antibiotics to the 
entire population of New Jersey. NJ public health officials preferred targeted prophylaxis 
that would concentrate distribution efforts in areas most affected by plague. Public health 
officials were concerned that the State could not staff the number of PODs needed to 
distribute prophylaxis to New Jersey’s 8.8 million residents. These officials also noted 
that distributing prophylaxis to everyone in areas where there were few cases of plague 
would have a marginal impact on the spread of the disease. Finally, they were concerned 
that prophylaxis distribution on this scale would divert resources away from areas heavily 
impacted by the disease and would endanger some residents {e.g., those living in areas 
with few plague cases) who were allergic to antibiotics. Despite these concerns, the 
political leadership pressed ahead with this decision. 

The T3 FSE cannot be used to assess the technical details concerning which prophylaxis 
approach (i.e., widespread or target distribution) was the correct choice; however, the 
exercise did illuminate important issues associated with the decision. 

Logistical and resource requirements associated with a more targeted prophylaxis would 
have been significantly less than the requirement for statewide prophylaxis. Choosing 
targeted prophylaxis would have simplified the POD planning process and applied the 
available resources to areas with the greatest need. The decision to pursue statewide 
prophylaxis increased the complexity of the planning process and created resource 
demands that could not be satisfied by the combination of State and Federal agencies. 

Although targeted prophylaxis requires fewer resources to execute, it does require 
significant data collection and analysis capabilities. When the release of a biological 
agent is suspected, response personnel and decision makers use epidemiological models, 
perhaps coupled with physical dispersion models, to determine the likely exposure 
location and to identify the at-risk population. Building accurate dispersion models 
requires information about the weather conditions, type of agent, method of 
dissemination, type and purity of the agent, time of the release, and extent of 
contamination (e.g., ground sampling results) for the case of an outdoor release of an 
aerosolized agent. These data are collected by several different organizations and are 
often incomplete during the initial phases of the response. 

Epidemiological models require a case definition and information from patients who 
present at health care facilities. During major disasters (e.g., terrorist incidents or public 
health emergencies), health officials assemble individual case definitions to identify 
clusters of victims. Patient data may be held by different organizations (e.g., multiple 
hospitals and private physicians) and are often incomplete during the initial stages of a 
public health emergency. To construct an accurate epidemiological model, public health 
officials must collect and analyze these data. 
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Dispersion models that are consistent with clusters of victims provide strong evidence 
that response officials have identified the release area. With dispersion models and 
epidemiological case information, officials can identify the release area and identify 
populations that are most in need of prophylaxis. In contrast, the primary pieces of 
information needed to support the decision to distribute prophylaxis to everyone are the 
identity of the agent and a definition of the target population (i.e., what constitutes a 
“resident”). 

Targeted prophylaxis has different public information requirements. In their public 
messages, officials must differentiate between the at-risk population and those who do 
not need prophylaxis. Furthermore, the public message must allay the concerns of those 
who should not receive prophylaxis. Otherwise, PODs may be overwhelmed by the 
arrival of too many individuals. The public me.ssage needed to support statewide 
prophylaxis can be less sophisticated; it simply needs to direct everyone to visit a POD as 
soon as possible. 

Early-warning biological detection systems, such as BioWatch,^ are intended to notify 
public health experts of the presence of a biological release and then assess the 
geographic extent of the contamination. Such information would aid officials in 
identifying the population most at risk and in determining which prophylaxis policy to 
pursue. Biological sensor systems could provide indications of the presence of plague 24 
to 36 hours sooner than relying on symptomatic case identification. 

Although a more focused prophylaxis effort may increase the possibility that some 
residents who need prophylaxis do not receive it, it can also reduce the distribution of 
prophylaxis to people for whom it is contraindicated. A prophylaxis effort of the scale 
notionally exercised in New Jersey will unnecessarily expose many more of these persons 
to potentially adverse effects, particularly if the standard of care is reduced in response to 
staffing shortages. 

3. Issues from Previous Exercises 

Like T3, T2 also exercised the SNS requisition process and the distribution of 
prophylaxis. Participants also raised related concerns during SOEs 05-2 and 05-3. Table 
IV-5 highlights issues across these exercises. 


^ hltp;//www. milnet.com/wh/DoHS/BioWalcliFactSheelFINAL. pdf (downloaded July 17, 2005) 
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Table IV-5. Comparison of T3 FSE with Previous Exercises 


T2FSE 

SOEs 05-2 and 05-3 

T3 FSE 

SIGNIFICANT DECISIONS 

• HHS directed COC to pre-deploy SNS 
push packs (prior to formal requests lor 
SNS) to Illinois. 

• The Stale also requested lollow-on 
managed Inventory supplies. 

• After issuing medicallons to first- 
resportder population, SNS sites opened 
to target poputatlon by Day 4. 

• After some discussion over the ability to 
conduct mass prophylaxis, local 
jurisdictions agreed on a common, 
targeted prophylaxis strategy. 

N/A 

• NJ Governor requested SNS on Day 

1 upon awareness of a plague 
outbreak. 

• NJ Governor decided to execute a 
statewide prophylaxis strategy, 
though State health officials 
recommended a targeted approach. 

• First State POD opened In one of 
the two most-affected counties by 
noon on Day 2. 

• The Federal government, concerned 
about the State's ability to execute 

Its plan swiftly enough, decided to 
supplement the State PODs with 
more than 160 of Its own sites 
located at postal facilities and 
private HRSA centers. 

ISSUES/OBSERVATIONS 

• Multiple requests for SNS from local 
jurisdictions; uncertainty about request 
procedures (via FEMA or COC) 

N/A 

• Single request from Governor 
directly to CDC 

« Significant uncertainty about amount of 
medications In SNS 

< Lack of consistent 
understanding among Federal 
0/As regarding capabilities 
(limitations of current national 
medical health care resources) 


• Concerns expressed by local 
jurisdictions regarding tradeoffs of 
targeted or mass prophylaxis strategies 

Some counties favored the targeted 
approach because they lacked the 
resources for mass distribution: those 
favoring a mass approach were concerned 
about being flooded with people from 
jurisdictions using a targeted approach. 

• Concern regarding ability to 
securely and swiftly breakdown 
and distribute the SNS on a 
massive scale (i.e., statewide 
prophylaxis strategy) 

• Throughput of real State PODs fell 
short of assumed rate of 1 ,000 
people/hour, a key assumption 
behind the mass prophylaxis 
decision adopted by the State. 

• Resources required to staff the 
nearly 400 State and Federal PODs 
were not Identified and were 
probably unavailable In the time 
frame of Interest. 

• The plan to conduct mass 
prophylaxis evolved during the 
exercise and did not appear to 
reflect a preplanned, carefully 
Integrated Federal-State response. 

• Not clear that the Federal 
government has a strategy for 
implementing Its own system of 

PODs or for rapidly identifying and 
supplying staff to support State 
efforts for large-scale requirement 


• Concern regarding emergency 
authorizations for new drugs or 
use of drugs for non-approved 
use 
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F. Recommendations 

• States need to work with the Federal government to develop scalable prophylaxis 
plans that contemplate a requirement to reach very large numbers of people. T3 
indicates the difficulty of doing this while an event is unfolding. 

o These plans will most likely require a combination of approaches, including 
fixed sites and delivery of prophylaxis directly to individuals. 

o There may be a requirement for flexible standards of care associated with 
different levels of prophylaxis. 

o States will need to clearly identify what Federal resources, if any, would be 
required to support these plans. 

• Careful integration of Federal and State planning processes is required to ensure that 
mass prophylaxis plans will be executable if needed. 

o The new HHS Regional Emergency Coordinators who report through the 
Office of the Assistant Secretary for Public Health Preparedness are well 
situated to facilitate this process. 

o Prophylaxis/planning practices and tools developed under the CRl should be 
expanded to include regions and cities not currently covered. 

o Options (including the appropriate mix of PODs plus other prophylaxis 
delivery techniques) for conducting large-scale prophylaxis should be studied, 
and guidelines should be developed. 

• The Federal government should decide whether it will establish and operate its own 
POD systems in the event of a major public health emergency like the one that 
occurred during T3. 

Even if it is not the intention of the Federal government to establish and operate its own 
POD systems in the event of a major public health emergency, plans should be made to 
quickly identify and provide staffing resources to States facing a need to carry out 
prophylaxis on a large scale, should their own resources prove inadequate. 
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IV. Agent Confirmation and Hazard Area Definition — 

Task # IV-6: Direct Agent Release Mitigation Efforts 

A. Summary of Issue 

The issue is that specialized response units did not exhibit a clear understanding of each 
other’s roles, authorities, and standard operating procedures. Additionally, the lack of a 
formally defined information flow process from the incident site resulted in premature 
public messages and decision making about the identity of the chemical agent. 

In a chemical, biological, or radiological attack, early identification of the lethal agent, 
combined with clear definition of the hazard area and the potentially exposed population, 
can save lives, speed effective treatment of symptoms, and prevent injury to medical 
responders. These essential elements of information drive decisions made by top officials 
at FSL levels. Information critical to rapid and effective response activities includes 
understanding what lethal agents were released, where they were released, and where the 
contamination is likely to spread. Scientists have developed plume models, which make 
use of available data to predict atmospheric transport of pollutants and to define spread of 
the agent. Models may also provide information that can help identify the timing and 
initial location of the agent release. Until recently, there was no single Federal source for 
collecting data and producing the modeling products used by decision makers. The T3 
FSE provided the opportunity to observe progress that has been made in creating a single 
authoritative Federal source for plume modeling, while highlighting issues that remain in 
coordinating data and information to confirm the agent and define the hazard area. 

The T3 FSE highlighted the potential for tension when many organizations participate in 
the sampling process and when information about the agent is not systematically 
distributed among the respon.se organizations. The response in Connecticut exercised the 
use of the Interagency Modeling and Atmospheric Analysis Center (IMAAC) as the sole 
Federal source of plume modeling during INSs. Observations indicate that the single- 
source IMAAC approach resolved much of the confusion about plume models noted 
during previous exercises. IMAAC products provided authoritative plume predictions 
that were used by alt the response organizations to define the hazard area and make 
associated decisions; however, problems with version control as well as lack of 
consolidation and confirmation of model inputs were evident during the exercise. 

Although the T3 FSE provided opportunities in New Jersey and Connecticut to learn 
about agent confirmation and hazard area definition during a major disaster, this analysis 
focuses on the observations and issues in Connecticut. Whereas plume modeling would 
be an important element of a real-world response to a plague release, exercise designers 
chose not to include it as part of the NJ exercise program; therefore, the IMAAC 
processes were not exercised in New Jersey and the IMAAC did not produce any official 
products for the plague release. 
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B. Background 

During WMD events, identification of the agent and definition of the hazard area 
provides information that governmental agencies can use to tailor the response and 
protect at-risk populations. Without ready access to this information, response 
organizations must make guesses about the type of agent and the boundaries of the hazard 
area, thereby reducing the effectiveness of the response and possibly endangering the 
responders and residents. 

1. Agent Identification and Confmnation 

Various FSL agencies have the capacity and responsibility to test for the presence and 
identity of WMD agents. Fire department personnel, specialized HAZMAT units, 
environmental agencies, and law enforcement personnel may perform environmental 
sampling. Medical personnel may collect samples from individuals to provide additional 
data about the agent. The overarching goal of all agencies is to identify the agent used in 
the attack and the extent of its spread. However, these agencies represent three different 
areas of interest: (1) first responders, (2) law enforcement, and (3) environmental 
remediation. Each interest group uses the results from the sampling differently and 
largely operates during different response phases: initial response to the emergency, 
criminal investigation, and clean up. Although the term “response phase” indicates a 
change in focus as a response progresses, there really are no clear lines of demarcation 
between the phases. Rather, overlapping and integrated operations occur across phases, 
with the understanding that priorities change over time. 

Fire and emergency medical services (EMS) personnel use the testing results to 
determine immediate treatment protocols and the appropriate personal protective 
equipment to use during the response period. Health care officials use the identification 
information to determine the best treatment for patients. Law enforcement uses results of 
the tests to support the investigation and prosecute su.spects. Environmental agencies use 
sampling to determine the extent of contamination and the best methods for remediation. 
Fire/EMS/medical personnel and environmental specialists could be grouped together 
based on their public health focus, with the former being concerned with immediate 
health effects, and the latter with a long-term perspective on the issue. To support their 
missions, all interest groups have developed and fielded the ability to collect samples and 
identify unknown agents. 

2. Hazard Area Definition 

When the presence of a chemical, biological, or radiological agent is suspected, response 
personnel and decision makers may use plume modeling and case definitions to 
determine the likely hazard areas and identify at-risk populations. With this information, 
responders can tailor their response to the scenario and decision makers can begin to craft 
policies that best address the circumstances of the release. 
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Plume models provide scientific predictions of how an agent will disperse given weather 
conditions and other factors. Initial plume predictions may be of limited value due to lack 
of knowledge about the means of dispersal, amount of agent released, and composition of 
the agent. However, these products still give decision makers some baseline information 
from which to craft a response. As more evidence is collected and field measurements are 
obtained, models are refined with this empirical data to produce more accurate analyses 
of the extent and spread of contamination. Model products are displayed via 
Geographical Information Systems (GIS) with affected population counts and detailed 
maps. With these products and reach-back support from modeling experts, top officials 
can make informed decisions about protective actions and response needs. 

At the Seattle, WA. RDD site during T2, the collection and analysis of data by multiple 
agencies at all levels of government resulted in inconsistent and potentially conflicting 
plume products. That experience prompted DHS and the HSC to create the IMAAC as 
the single source of Federal plume modeling and analysis in the event of an INS. The 
IMAAC is intended to be the center or facility where all agencies who support hazard 
area modeling for different consumers can co-Iocate representatives to participate in 
analysis and reach consensus on products. Under the MOA that established the IMAAC, 
agencies with particular customers, such as the Defense Threat Reduction Agency 
(DTRA), continue to deliver products to their customer(s) but coordinate with the other 
agencies in the IMAAC to reach a consen.sus on the asse.ssments during an INS. The 
National Atmospheric Release Advisory Center (NARAC) at Lawrence Livermore 
National Laboratory (LLNL) in California currently functions as the interim IMAAC 
facility. The IMAAC accepts inputs and product requests from any of the Federal agency 
signatories to the MOA. any State or tribal organization, and any FSL emergency 
response organization. End users can download the IMAAC products from the NARAC 
secure website or can request receipt over e-mail. The goal of the IMAAC agreement is 
to reduce confusion and uncertainty among response organizations about the plume 
models. By providing an authoritative, single source for plume predictions. IMAAC can 
contribute to a shared situational awarene.ss among response organizations. 

The IMAAC policy was codified in the NRP and in an MOA sponsored by DHS. The 
signatories to the MOA include the Department of Energy. Department of Commerce, 
DoD, Department of the Interior, National Air and Space Association (NASA), Nuclear 
Regulatory Commission (NRC), Environmental Protection Agency (EPA), and DHS. 

C. Reconstruction 

The T3 FSE provided an opportunity to learn about the response mechanisms that 
officials use to identify and confirm unknown WMD agents and define hazard areas 
during an incident response. In Connecticut, officials were responding to the release of a 
fast-acting sulfur mustard agent, from which victims exhibited symptoms within hours of 
exposure. The terrorists used two methods to disseminate the mustard agent in 
Connecticut. First, at approximately 1 1:30 on April 4, a small aircraft flew over the New 
London City Pier on the Thames River releasing mustard in a gaseous form over the 
waterfront area. Roughly two hours later, at 13:20, a VBIED, hidden in the back of a 


UNCLASSIFIED - TOUQ 

This Document Contains Canadian and United Kingdom Information 

227 





AAR 


TOPOFF 3 


truck that also carried sulfur mustard detonated at the head of the pier. Most of the 
mustard agent present in the truck bomb was destroyed during the explosion, limiting 
contamination to the immediate vicinity of the detonation, where a pool of mustard agent 
had collected prior to the explosion. The aircraft release contaminated a much larger area 
and had a greater impact on the people attending the festival at the pier. 

J. Agent Identification and Confirmation in Connecticut 

The New London Fire Department first responders arrived within five minutes of the 
blast, and recognized immediately that the victims at the pier were suffering from more 
than just the effects of a truck bomb. Their initial monitoring and metering revealed the 
presence of a chemical agent. From there, the Incident Commander (IC) coordinated all 
the HAZMAT and specialized units that arrived on scene to test for the agent. With the 
FBI WMD Coordinator advising, the IC developed a testing plan that increased in 
sophistication as it progressed while limiting contamination of evidence and duplication 
of effort. First, the CT State Police Emergency Services Unit (ESU) entered the scene to 
conduct paper tests, which revealed the area to be positive for a blister agent. Next, the 
CT National Guard Civil Support Team (CST) was sent to the perimeter of the site to 
monitor air and wind movements to make sure the wind did not shift and contaminate the 
first responders. Based on the paper tests, air monitoring, and victim symptoms, a 
presumptive positive assessment of mustard agent was made at 15:37 and passed to 
operating centers and decision makers. At this time, there was no .scientific evidence of 
mustard agent.*^ The next test, by the CT DEP HAZMAT Unit, used a gas 
chromatograph mass spectrometer (GCMS) to survey the clothing of one of the victims. 
This test came back negative, an artificiality of the exercise that may have changed the 
course of the testing plan if not for the controller intervention. Fourth, the National Guard 
CST used a second, more advanced GCMS to test a clothing sample. Per the Master 
Scenario Event List (MSEL), this test at 20:17 was positive for mustard. Although the 
equipment used by the DEP and CST is virtually identical to that used in a sanctioned 
laboratory, the environment is not considered pristine enough for definitive testing, 
particularly for a criminal investigation. Field tests are usually considered preliminary 
results, with definitive testing occurring in a laboratory. Very early on in the response, 
the CT State Police ESU collected a sample for the FBI to send to the Edgewood 
Chemical Activity (ECA) in Aberdeen, MD, for definitive testing. At 08:40 on April 5, 
the ECA confirmed that the samples contained mustard. 

Concurrent with the efforts at the incident site, the CT Department of Public Health 
(DPH) initiated its own line of testing to confirm the identity of the chemical agent. CT 
DPH received notification of the preliminary mustard identification, but questioned the 
source and accuracy of the information. Not knowing about the airplane dispersal, which 
occurred two hours prior to the explosion, CT DPH and the treating hospitals reasoned 
that the contaminant could be lewisite, rather than mu.stard, because of the apparently 


Although it is possible that the initial tests and victim symptoms would have led responders to suspect 
mustard, it is unlikely that they would have been as certain in their diagnosis if not for the artificiality of 
the exercise. All participants knew ahead of time that the agent being simulated was mustard. 
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short time span between victims being contaminated via the truck bomb and victims 
becoming symptomatic. Using skin and blood samples from patients, the CT DPH 
laboratory confirmed the presence of mustard at 01:34 on April 5. 

2. Hazard Area Definition in Connecticut 

Even before the agent was identified, officials in Connecticut implemented two 
approaches to define the hazard area: plume modeling and environmental sampling. 

The IMAAC was alerted to the explosion by VNN shortly after the bomb detonated. 
Once alerted, the IMAAC began modeling the potential effects of a chemical release in 
the event that such a release had occurred concurrent to the explosion. At 13:40, the 
IMAAC Operations cell began conducting sample runs of a plume model using mustard 
as the agent.*’** The DHS Science and Technology (S&T) Division watch officer at the 
HSOC activated the IMAAC at approximately 13:53. IMAAC was asked to produce an 
initial set of plume products based on VNN reports, with more detailed information to be 
included as it became available. The IMAAC released the first plume product via the 
NARAC website at 14:36. Figure V-1 shows the initial plume prediction. 


Although the fortuitous use of mustard in the earliest run model was likely an artificiality of the exercise, 
the fact that IMAAC began modeling even before formal notification is not unusual. IMAAC operations 
personnel report that learning of any bombing, accidental release or spill, or national emergency would 
activate an informal IMAAC modeling response in the event that formal activation occurred. 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

229 





AAR 


TOPOFF 3 


Figure V-I. Initial IMAAC Plume Model Released at 14:36 on April 4 
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At 15:30 on April 4, the Secretary of Homeland Security declared the events in 
Connecticut an INS and by default identified the IMAAC as the single source for Federal 
plume models of the effects. Over the next four days, the IMAAC released seven 
additional sets of plume products, as well as some revisions to specific model runs within 
the sets. 

Under the authority of the NCP. the ERA. U.S. Coast Guard fUSCG), and Connecticut 
DEP developed a sampling and monitoring plan to detect the continued presence of 
mustard agent and delineate the extent of contamination. On April 5, sampling and air 
monitoring teams comprised of personnel from the Connecticut DEP HAZMAT Team, 
EPA Region 1 HAZMAT Team, EPA Superfund Technical Assessment and Response 
Team (START), and USCG National Strike Force/Atlantic Strike Team (NSF/AST) 
implemented the plan in the areas immediately surrounding the incident site. Early 
evening on April 5. the teams received access to the hot zone at the incident site for 
testing purposes. Field operations concluded at 14:36 on April 6, with a total of 36 
samples taken. The results from these field samples were sent to the IMAAC and 
contributed to the development of more accurate plume products. 
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Figure V-2 shows key events in the Connecticut incident and response. 

Figure V-2. Key Events for Agent Identification and Hazard Area Definition in 
Connecticut 
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D. Consequence 

Exercise play in Connecticut presented respionse organizations with an opportunity to 
exercise the coordination processes required for identification of the chemical agent and 
definition of the hazard area. Overall, these activities appeared more coordinated, 
efficient, and .successful than in T2. In particular, the T3 FSE also showed how much 
improvement has been made since T2 in coordinating and developing analysis products 
to support top officials' decision making about the hazard area and the effects of 
contamination on the population. Despite these success stories, T3 showed that room for 
improvement still exists, 

T3 illustrated the potential for tension when many organizations participate in response 
activities without a clear understanding of the roles, standards, and operating procedures 
of other responders on site. This tension is neither new nor unexpected. However, such 
issues take on added weight when they have repercussions that reverberate up the entire 
response chain. In Connecticut, these tensions manifested themselves onsite in 
disagreements between different chemical sampling units and communities. Among the 
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results was a delay in top officials receiving essential elements of information to help 
with decision making and the contamination of evidence that could be needed for 
criminal prosecution. 

Play in T3 duplicated that of T2 in terms of a breakdown in information flow from the 
incident site to the other organizations and operating centers in the response chain. In T3, 
this was evidenced by many incorrect and unconfirmed reports of the agent being 
mustard. T3 showed that a systematic process for releasing information from the site does 
not exist. The result is presumptive and potentially incorrect information being used by 
decision makers and given to the public. In the T3 FSE, responders were fortunate that 
the rumors and preliminary reports were accurate. In the future, responders may not be so 
fortunate. Information about the contaminating agent, and any other essential elements of 
information that may drive FSL actions as well as public responses, needs to come from a 
single authoritative source that is acknowledged as such by the entire response chain. 

The use of the IMAAC in T3 as the single authoritative source for Federal plume 
products resulted in dramatically less confusion regarding such products than in previous 
exercises. The few problems that occurred involving version control and non-lMAAC 
analyses were insubstantial and could be attributed to technology issues. That being said, 
the IMAAC processes for receipt and review of other modeling products may need to be 
reclarified, and a protocol may need to be established for other modeling agencies to 
distribute to their consumers on the purpose of their products and the guidelines for 
redistribution. 

Events in T3 indicate that the creation of IMAAC as the single source for plume products 
was a good decision. Now, however, processes associated with providing data and 
requesting products may need to be reexamined. The IMAAC is not equipped to 
consolidate the inputs it receives and resolve discrepancies among them. Serious 
consideration should be given to the decision to allow multiple agencies at FSL levels to 
have direct access to the IMAAC operations cell. The response flexibility granted by such 
access should be weighed against the potential for conflicting inputs or requests. 
Procedures need to be developed on how the IMAAC should handle discrepancies in data 
inputs and requests that do not align with previously provided inputs or scientific 
evidence. Finally, the IMAAC needs the authority and access to more effectively inject 
its evidence into top officials’ decision-making processes. 

E. Analysis 

The T3 FSE play in Connecticut provided an opportunity to learn about agent 
identification and hazard area definition during a major disaster. The exercise highlighted 
the potential for challenges when many organizations participate in the sampling process 
and when information about the agent is not systematically disseminated among the 
response organizations. The exercise also provided an opportunity to exercise the 
IMAAC MOA and observe its impact on the response. Although room for improvement 
exists, the use of the IMAAC appeared to reduce the amount of conflicting plume 
information received by decision makers in previous exercises. 
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Response agencies and organizations in Connecticut accurately identified mustard as the 
agent used by terrorists. The actions taken and decisions made with respect to the agent 
identification and confirmation process revealed areas of concern associated with: 

• the coordination of emergency responders, law enforcement, and environmental 
responders at the incident site; and 

• the flow of information about the contaminating agent. 

The use of the IMAAC as the single source for plume models successfully reduced the 
number of conflicting products provided to decision makers and contributed to a common 
picture across the various response organizations and command centers. Although T3 
showed significant improvement over T2 in this respect, there remains room for more 
improvement, particularly with: 

• continued availability of additional plume products and analysis; 

• managing contradictory reque.sts for the IMAAC products; and 

• coordination of emergency responders, law enforcement, and environmental 
responders on scene. 

/. On-Scene Coordination of Emergency Responders, Law Enforcement, and 
Environmental Responders 

Events at the Connecticut incident site highlighted the potential for confusion or tension 
when many organizations participate in the sampling process without clear understanding 
of each other’s roles, authorities, and standard procedures. 

First responders in Connecticut quickly recognized that there was a potential WMD 
component to the attack. They appropriately made note of the symptoms they were 
seeing, and recognized that victims complaining of garlic smells and exhibiting blisters 
were beyond the expected repercussions of a simple explosion. Ba.sed on these reports, 
WMD-specific responders arrived on the scene quickly, and testing of the agent 
progressed at a rapid pace. 

Multiple State and Federal agencies dispatched HAZMAT units to the scene shortly after 
it was identified as a WMD event. Data show that the local FBI requested that agency’s 
specialized units and the State Police ESU, and the Governor activated the National 
Guard CST. The HAZMAT units from the USCG, Connecticut DEP, and EPA arrived 
under their NCP authorities. Within two hours of the explosion, at least five specialized 
units were on site with the capability of testing for contamination and supporting agent 
identification efforts. Over the course of the four-day exercise, nine specialized units, 
with different primary responsibilities, supported efforts on scene associated with agent 
confirmation and hazard area definition. Table V-1 identifies the agencies and units that 
responded to the scene, the day they arrived, and an assessment of their focus based on 
T3 observations. 
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Table V~I. Agencies Supporting Sampling at the Incident Site in Connecticut 


Responding Agency/Unit 

Focus 

Date of Arrival 

New London Fire Department 

Emergency response 

April 4 

CT DEP HAZMAT Team 

Emergency response and 
remediation 

April 4 

National Guard CST 

Emergency response 

April 4 

U.S. Navy Groton Submarine 
Ba.se HAZMAT Team 

Emergency response 

April 4 

FBI WMD Coordinator 

Law enforcement/criminal 
investigation 

April 4 

CT State Police ESU 

Law enforcement/criminal 
investigation 

April 4 

EPA Region 1 HAZMAT 

Remediation 

April 4 

USCG Atlantic Strike Team 

Remediation 

April 4 

FBI Boston HAZMAT 

Response Team (HMRT) 

Law enforcement/criminal 
investigation 

April 5 

FBI HAZMAT Response Unit 
(HMRU) 

Law enforcement/criminal 
investigation 

April 5 

EPA START 

Remediation 

April 6 


The initial emergency response phase of the operation, during which responders focused 
on immediate situational assessment and victim recovery, lasted just seven hours — from 
the time the VBIED detonated to 20:00 on April 4, when the 1C turned over control of the 
site to the FBI. The investigation phase lasted until early evening on April 5. or 
approximately 24 hours, when the FBI concluded its evidence collection efforts and 
turned the site over to the EPA and Connecticut DEP for sampling. Initial remediation 
efforts, predominantly sampling and monitoring to determine the extent of contamination 
at the site and in surrounding areas, began almost immediately and lasted through the end 
of the exercise. Long-term remediation and recovery efforts would have continued 
beyond the T3 FSE conclusion. 

As Table V-1 indicates, most of the specialized units that responded to the scene arrived 
on the first day of the response effort. Although it was clear that efforts on April 4 were 
focused on emergency response and victim recovery, there were some instances of 
tension among sampling units concerned with public health concerns and those 
concerned with the criminal investigation. Some of this tension may have been a result of 
the artificiality of the exercise, but a lack of understanding appeared to exist across all the 
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units about standards and operating procedures followed by other responders and interest 
groups carrying out their own respective duties and responsibilities. 

For example, law enforcement HAZMAT specialists, represented in Connecticut by the 
FBI and the State Police ESU, have two primary concerns during the initial emergency 
response phase. First, they seek to minimize damage to or contamination of evidence on 
scene. To this end, the FBI WMD Coordinator worked with the IC and first responders to 
identify the least damaging routes in and out of the site and oversaw collection of a small 
number of pristine evidence samples before emergency personnel entered the detonation 
area. Second, law enforcement personnel strive to maintain control of all potential 
evidence or data for future prosecution of the perpetrators. To this end, the FBI WMD 
Coordinator attempted to influence the type of field tests performed and the order in 
which they were conducted to minimize the possibility of contradictory results that could 
be used later by a defense counsel. Law enforcement personnel are also concerned with 
the chain of evidence and maintaining positive control of evidence at all times. In 
suspected terrorist incidents, all samples are evidence, even those being used by 
HAZMAT personnel, medical workers, and environmental units to assist with medical 
treatment, decisions about protective gear, or definition of the hazard area. To support 
this responsibility, the WMD Coordinator assigned CT State troopers to accompany all 
samples that went for testing. This practice became problematic when the National Guard 
CST collected samples for testing in its mobile field unit. Although the test the team 
performed on the sample is standard, the mobile unit itself is classified, and the State 
trooper did not have the clearance required to enter. This disrupted the evidence chain, 
from a control standpoint and in terms of having someone available to testify to the 
results later. 

The T3 experience leads to questions regarding the presence of multiple assets with 
duplicative capabilities at the site, particularly those without specific responsibilities or 
authorities. Although the speed with which they all arrived in the T3 FSE is likely 
unrealistic, the fact remains that the presence of multiple units with similar capabilities 
cun easily lead to duplication of effort, lack of understanding of different units' 
responsibilities or authorities, and counterproductive jurisdictional issues. The onsite 
presence and early activities of so many testing and sampling assets may be redundant in 
the first 12 hours of the response. However, some experts argue that having more assets 
available to support testing efforts gives the IC and senior law enforcement officials more 
flexibility in designing a test plan to support the needs of public health and the criminal 
investigation. In the exerci.se, that flexibility allowed the test plan to build in 
sophistication from paper testing indicating a blister agent to the use of advanced GCMSs 
that are virtually identical to the equipment used by accredited laboratories. 

A second issue was associated with access to the incident site itself. The FBI took control 
of access to the site shortly after arriving early in the afternoon on April 4, though the IC 
still controlled operations. This allowed law enforcement to admit units or deny access to 
units. The National Guard CST, under orders from the Governor to report to the incident 
scene and support the IC, was denied access to the site and the Incident Command Post 
(ICP) for approximately two hours on April 4, when responders were still in the 
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emergency phase of the response. The data do not provide details on why the CST was 
initially denied access or why the decision was eventually reversed. Additionally, on 
April 5. there was poor coordination about when the remediation units would receive 
access to the site for field measurements, an issue of key interest to officials at all levels 
of the response. The initial sampling plan called for remediation units to begin testing on 
site the morning of April 5. However, that morning, the FBI informed the rest of the FSL 
agencies present that law enforcement’s control of the site would continue for most of the 
day, and that sampling units would not be allowed to begin their on-scene efforts until 
evidence collection had concluded. For most of the day, the remediation units were 
limited to sampling outside of the FBI’s perimeter. 

The discussion over access progressed all the way up to the JFO Coordination Group and 
the PFO for deliberation during a 14:30 meeting on April 5. At that level, the 
communities are largely divided into two groups; law enforcement and public health, 
with the latter also including environmental assessment and remediation. Although the 
law enforcement community recognizes the priority of emergency response over the 
investigation, the same is not true of remediation efforts, which are considered lower 
priority than the investigation. However, the sampling conducted by the USCG, EPA, and 
CT DEP was aimed at more than just long-term cleanup. The sampling results 
contributed to the IMAAC plume models and were essential for decisions about 
sheltering-in-place, school and business closings, and mass care needs. The delay in 
getting complete results did not seem to be well understood by decision makers at the 
State and Federal levels. 

2. Flow of Information About the Contaminating Agent 

Information that mustard was the chemical agent used in the attack did not filter up to 
decision makers and out to the public in an organized and controlled process. Instead, top 
officials began making decisions and statements to the public based on unconfirmed 
information and did not consider alternative hypotheses. For example, initial data from 
the Connecticut DPH showed that other agents, such as lewisite, could have been the 
source of victims’ symptoms. If the early rumors about mustard had proved false, this 
could have had significant impact on response operations, including decontamination 
efforts, victim treatment, and public guidance. Immediate acceptance of presumptive 
confirmations of the agent in T3 may have been due, in part, to exercise artificiality. 
Exercise participants had advance knowledge of the agent being simulated, and as a 
result, may have been more inclined to accept unconfirmed hypotheses as fact. However, 
data still show the lack of a clear process for communicating and controlling such key 
pieces of information, and the potential for rumor to quickly become accepted as fact 
during a crisis. 

In Connecticut, the first test-based confirmation that a mustard agent was released at the 
incident site occurred at 20:17; however, reports on the presence of mustard occurred 
well before that preliminary confirmation. As previously noted, first responders in 
Connecticut quickly recognized that there was a potential WMD component to the attack. 
Initial assessments of the situation were based on victim reports and symptoms. 
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Therefore, before conclusive testing, responders suspected a chemical blister agent like 
mustard. These suspicions quickly took on the appearance of fact as the information left 
the incident site. Table V-2 lists all the mustard agent reports prior to the 20; 1 7 field test 
and an assessment of whether the report was based on information available at the time. 


Table V-2. Reports of Mustard Agent Prior to the 20:17 Confirmation on April 4 


Time of 
Report 

Report of Mu.stard Agent 

Based on 
Available 
Information? 

14:20 

FBI WMD Coordinator tells IC that symptoms 
suggested mustard. 

Yes 

14:50 

IC tells 911 dispatcher and New London EOC that 
the contaminating agent was mustard. 

No 

14:55 

VNN broadcasts an unconfirmed report of mustard 
found at the incident site. 

Yes 

15:05 

Operations Chief in State EOC briefs that mu.stard is 
suspected but awaiting confirmation. 

Yes 

15:13 

City Manager in New London EOC confirms that 
mustard was used in the incident. 

No 

15:33 

IC allows the PIO on scene to release reports of 
mustard. 

No 

16:27 

State Police reports to the State EOC that the 
presence of mustard has been confirmed. 

No 

16:58 

1C Informs the PIO that mustard has not been 
confirmed, but is suspected. 

Yes 

17:02 

On VNN, Secretary of Homeland Security 
announces confirmation of the presence of mustard 
at the CT site. 

No 


The only public safety agency or operating center that appears to have hesitated to accept 
these unconfirmed reports was the CT DPH. At the DPH Emergency Control Center 
(ECC), the toxicologist and other health professionals on duty discussed the rapidity of 
the onset of symptoms. They determined that the symptoms appeared too quickly for the 
agent to be mustard if the truck explosion was the means of release. These officials 
initially suspected that the agent was lewisite. The public health community was 
concerned with an accurate confirmation of the agent, because mustard and lewisite have 
different treatment protocols and decontamination requirements. Therefore, if hospitals 
were treating patients for mustard exposure, their efforts would have been less than 
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Optimal if the contaminant turned out to be lewisite. As a result, at 15:22, the CT DPH 
advised the State HOC not to release information about mustard until its presence had 
been confirmed. Even after the preliminary confirmations of mustard by the FBI were 
issued, the CT DPH continued to question the result until the State laboratory or the CDC 
verified it, which occurred early in the morning on April 5. 

Complications in the flow of information about agent confirmation highlights another 
seam between the public health and criminal investigation communities, and their 
requirements as to what it takes for an agent to be “confirmed.” For the law enforcement 
community, “confirmation” has legal ramifications, whereas for the rest of the responder 
community, confirmation drives public health and continuity of operations decisions. The 
FBI considers all instrumented monitoring tests conducted in the field to be preliminary. 
They use these results as guidelines for packaging evidence and practicing the 
appropriate safety precautions. Onsite testing is not definitive and cannot be used to 
support the prosecution of those responsible for the release. As a result, the FBI was 
reluctant to confirm the presence of mustard until it received results from EGA. Although 
the other organizations that collected .samples immediately confirmed the presence of 
mustard, the FBI waited until 18:39 to report its suspicions to the JFO Coordination 
Group, Unified Command, and State EOC. As late as 23:15 on April 4, the FBI JOC told 
the State EOC that it was still not willing to announce confirmation of mustard to the 
press. 

In general, the language used in reference to agent identification and confirmation is not 
specific enough to distinguish between the nuanced definitions of “confirmed" required 
by different responding communities and top officials. During T3, clear guidance was not 
available about the differences between confirmations that were presumptive, 
preliminary, or definitive. Nor did there appear to be widespread efforts to appropriately 
label confirmations as such. Instead, there appeared to be a lack of shared understanding 
at different levels of the response as to the definitive nature of the early reports from the 
site. The result was having preemptive, and at times incorrect or contradictory, reports 
flow up and down the response chain and to the public. 

Ambiguous language is not the only explanation for the unclear status of agent 
identification and the release of information before it is confirmed. In the end, the 
problem comes down to having clear, explicit channels for information flow — channels 
that responders at all levels can rely on to send and receive valid information. 

The T3 FSE highlighted legitimate gaps in the process of moving information from the 
incident site to the various command centers. Specifically, it was never clear: 

• who was responsible for official confirmation of the contaminant, both to the 
public as well as to FSL agencies involved in the response; 

• when that information should be pushed out; and 

• how that information should be disseminated. 
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The NRP establishes a theoretical information flow from the ICP through the local and 
State EOCs, up to the Federal responders in the JFO, then on to the HSOC and IIMG. But 
the reality in Connecticut was much more complex considering the large number of FSL 
agencies represented at the incident site, the activation of an off-site Unified Command 
with predominantly Federal membership, and the very realistic demand for information 
from decision makers and the media. Information was being pushed and pulled from all 
directions. Although much of the preemptive agent confirmations and notifications in the 
exercise could be attributed to the artificiality of an exercise in which everyone knows the 
agent ahead of time, the fact remains that the situation is rife with the potential for 
miscommunication, rumors, and ambiguous statements from the scene. Information not 
clearly and systematically disseminated with the necessary level of detail and 
clarification may be misused or misunderstood. 

3. Presence of Additional Plume Products and Analysis 

T3 showed marked improvement over T2 in the use of plume products to support 
definition of the hazard area in Connecticut. The single-source IMAAC approach 
resolved much of the confusion about plume products noted during T2; however, the 
existence of additional plume products in T3 still caused some problems. 

a, Version Control of IMAAC Products 

During the exercise, decision makers faced some challenges concerning the number of 
IMAAC model runs completed and products distributed during the exercise — essentially 
a problem of version control. These products had differences ranging from slight 
revisions to different driving assumptions. Early model runs were not effectively taken 
out of play or retired, and it was often unclear which model run was the most current. As 
a result, there were instances in which command centers or participants not co-located 
were referring to different products. Problems with version control are a common result 
of distribution processes and the time lag between receipt and onward distribution of 
updates. 

The IMAAC operations cell used two methods to disseminate its products: 

• Products were posted on the NARAC website. Individuals located at the New 
London EOC, State EOC, JFO, and HSOC, as well as various agency 
headquarters and operating centers, could download the plume analysis from the 
NARAC site and display it on a choice of CIS maps.^ NARAC account holders 
in the key operating centers were identified prior to the exercise, and the IMAAC 
had a process in place to quickly set up new accounts as needed. Account holders 
received an e-mail notification whenever a new model run was posted. 


The broad selection of GIS maps means it is possible for users to be looking at the same IMAAC results 
but in different perspectives and with varying levels of underlying detail. This may have caused some 
confusion at times in T3. 
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• An electronic slide presentation of the IMAAC model results with explanatory 
information was sent via e-mail to all the NARAC account holders and any other 
individuals who requested the products over the course of the response. 

Users accessing the IMAAC data via NARAC required some level of training to 
download the analysis and generate products using the web-based GIS maps, but once 
trained, they could view the results on their preferred maps. Users relying on the 
electronic slides sent via e-mail received ready-to-view products with an identifying set 
number to distinguish them from previous products. These products could not be 
manipulated and arrived approximately 20 minutes later than the e-mail notifying 
NARAC system users of new product postings. This time delay could explain some of 
the instances when individuals referred to different products. 

Additionally, not all command centers and officials have their own NARAC accounts. In 
Connecticut, the Geospatial Laboratory representative at the State EOC was tasked with 
downloading IMAAC products and posting them to the State web portal for multiagency 
use, Although this worked for the most part, it could have led to delays in some State and 
local agencies or operating centers receiving products. For example, the posting of the 
second set of plume products to the State intranet did not occur until 17:30, though the 
product was released by the IMAAC at 16:06. Moreover, it appears that some State 
agencies were either unaware of this service or unable to access the portal. Data indicate 
that on April 4, the State Police and CT DPH were without plume products at 20:00 and 
20:23, respectively, although by that time the IMAAC had relea.sed three sets of products. 

Another potential explanation for version control problems is the fact that due to 
available technology, products are widely distributed so quickly that records do not exist 
for everyone who may have received pa.st products. Therefore, there is no way to ensure 
that all those individuals or agencies receive updates. The IMAAC does record all 
outgoing e-mails so that anyone who received previous versions will also receive new 
products. But, once the data pass that first link in the communications chain, there is no 
way to manage updates and version control across the board. 

b. Non-IMAAC Products 

The declaration of the CT bombing as an INS made the IMAAC the single Federal source 
for plume models. However, this did not stop other Federal agencies from modeling the 
effects. Per the MOA, other agencies may continue to model for their particular 
consumer, but must forward their products to the IMAAC and seek consensus. With one 
exception, this approach worked. At approximately 1 1:16 on April 5, the DTRA issued a 
document purporting to explain some discrepancies in the IMAAC product. The DTRA 
report caused some confusion among players because it contradicted the single source 
approach to modeling, but it did not appear to drive any decision changes. 

The DTRA product that made its way around operating centers in Connecticut was not 
disseminated by the agency itself. Rather, it appears that DTRA issued the product to its 
consumer. DoD Northern Command (NORTHCOM), who then distributed it to the 
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DCOs and other military representatives in the various operating centers. From there, as 
with the IMAAC products, the document was pushed outside of its distribution chain. 
DTRA and other agencies modeling hazard areas can only control the list to which they 
send products. The MOA does not cover any further distribution that may overlap with 
IMAAC. 

During the T2 FSE in Seattle, WA, the existence of multiple plume products resulted 
from independent modeling efforts by various agencies at FSL levels. During that 
exercise, local and State EOCs and local and State public health departments generated 
plume predictions. These varying products, coupled with the predictions generated by 
four Federal agencies, complicated decision making at all levels. The MOA establishing 
the IMAAC as the sole source for Federal plume products largely eliminated half of the 
problem experienced in Washington: that of conflicting Federal predictions. The 
complications generated by State and local products was never an issue in T3 because 
there are no data indicating that New London or the State of Connecticut had initiated or 
had attempted to initiate its own modeling capabilities. Rather, the State went 
immediately to the IMAAC for plume products. 

4. Managing Contradictory Requests or Inputs to the IMAAC 

Over the course of the four-day exercise, the IMAAC Operations Cell produced and 
released eight sets of plume products, as well as some revisions to specific inputs within 
the sets. The IMAAC produces new model runs when one of two things happens — either 
the cell receives a specific request for an updated product, or the cell receives new input 
or data that the modelers know will impact the plume picture. Table V-3 identifies when 
each set of products was released, the requesting or inputting agency, and the different 
assumptions used in developing the .set. 
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Table V-3. IMAAC Model Runs Produced for Connecticut 


Set# 

Time of 
Release 

Requesting 

Agency 

Input Assumptions 

1 

14:36, April 4 

DHS S&T (HSOC) 

- 55-gallon drum of mustard exploded 
with 100-kg HE 

2 

16:06, April 4 

CT DEP (State 

EOC) 

- Confirmed location at New London City 
Pier 

- Refined explosion source and details 

3 

19:17, April 4 

NOAA (HSOC) 

- Aircraft release with west to east flight 
path 

4 

23:50, April 4 

T3 SIMCELL’“ 

- Calibrated with 13 field measurements 

- Aircraft release of .300 kg of mustard 

- Updated festival population data 

5 

08:00, April 5 

CT DEP (State 

EOC) 

- Combined 60-kg aircraft release and 10- 
gallon ground release 

2P 

09:35. April 5 

DHS S&T (HSOC) 

- Same as set 2, but with updated festival 
population data 

6 

14:30, April 5 

CT DEP (State 

EOC) and IIMG 

- Combined 274-kg airborne pure-vapor 
release and 18.8-kg evaporation release 
from truck 

7 

16:00, Aprils 

CT DEP (State 

EOC) 

- Added 10 gallons to airborne release 

- Controller-confirmed location of 
explosion 

- Ground-based sprayer source 

- Calibrated with 87 field measurements 

7A 

23:00, April 5 

IIMG 

- Same as set 7, but with reduced amount 
and assumed duration of group 
evaporation release 

8 

16:00, April 6 

DHS S&T (HSOC) 

- Combined airborne (droplet and vapor) 
release and truck spill 

- Calibration with 158 field measurements 


™ The T3 SIMCELL injected data representing the results of field measurements taken by the joint 
sampling teams. At the time of the first inject, the sampling activities were still notional, and specific 
teams or leaders had not been identified. Later, field measurement injects were provided directly to the 
sampling teams, who passed the information through their respective reporting chains, EPA and CT DEP, 
and onto the IMAAC. 
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As can be seen from Table V-3, the agencies providing inputs and requesting models 
were about evenly split between Federal and State agencies. All the requests made by 
Federal agencies were actually made by agencies' watch officers in the HSOC on behalf 
of the IIMG. Connecticut made its requests through the CT DEP Geospatial 
representative in the State EOC. The State was more active in making requests than the 
IMAAC operators expected. By design, the IMAAC can accept inputs and requests from 
any of the Federal agencies designated as Authorized IMAAC Requestors (AlRs), any 
State or tribal organization, and any FSL emergency response organization. For the latter 
group, IMAAC must request authorization from the HSOC S&T Officer, but will conduct 
the analysis in parallel to the authorization effort. All of this flexibility means that 
IMAAC is able to respond rapidly to a situation even before the rest of the Federal 
response apparatus is fully activated. 

However, the IMAAC’s ability to coordinate with response organizations at all levels and 
locations means consolidation of inputs and requests is only happening at the IMAAC 
itself. The IMAAC CONORS document prepared for T3 states: 

When an Incident of National Significance is declared, the IMAAC 
will he the single point of distribution for Federal plume products. 

IMAAC will support the DHS-designated PFO (if appointed) and 
his Joint Field Office Coordination Group or the Federal 
Coordinating Officer (FCO) through di.strihution of products and 
technical expertise to State and local response.^' 

This seems to suggest that the IMAAC would work through the JFO Coordination Group 
to provide analytical services to the State. However, the CONORS also states: 

The IMAAC will work directly with Federal, State, and local 
agencies technical as.sets and regional or national incident 
response teams to provide the most accurate, reliable, and timely 
estimates of plume hazard predictions and impacts possible. The 
IMAAC will continue to refine products based on newly obtained 
data, improved input information, and the use of additional 
simulation tools. 

The latter statement suggests that during the T3 FSE, local and State agencies were not 
required to work through Federal representatives to provide inputs or request model runs. 
In fact, the CT DEP Geospatial representative in the State EOC had a direct line to the 
IMAAC and requested half of the analyses produced. This approach is consistent with the 
role of the Federal government in support of a State response and is part of what makes 
the IMAAC so flexible and responsive. The concern is what the IMAAC should do if it 
receives inputs and requests from one level or agency of government that vary from those 


” Memorandum dated March 30, 2005, Department of Homeland Security Interagency Modeling and 
Atmospheric Analysis Center (IMAAC) Concept of Operations for the 2005 TOPOFF3 Exercise, from 
Bruce A. Davis (Interim IMAAC Director. DHS S&T, EPR) and Ron Basket! (Interim IMAAC 
Operations Manager, LLNL, National Atmospheric Release Advisory Center). 
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received from other parts of the government, or if it receives requests that will not 
produce a valid output based on scientific evidence. 

For example, in the initial requests for a plume product, the IMAAC Operations Cell 
received inputs from three different sources regarding the location of the explosion — the 
State Pier, the City Pier, and Fort Trumbull. The third location was an artificiality of the 
exercise, but the confusion over the pier site is realistic. The IMAAC Director had to 
delay release of that initial plot while he sought clarification from his sources on this 
critical element of information. 

In another example, the IMAAC determined from the initial set of field measurements, 
injected at 19:30 on April 4, that the bulk of the agent had to have been released from an 
airplane; this scientific conclusion supported the FBI's investigation of the crop duster in 
Maine and was released in set 4 of the IMAAC products. However, the next day, the 
IMAAC Operations Cell continued to get requests for products that did not incorporate 
an airplane dispersal: the CT DEP requested an updated model run based on a ground 
release, and the DHS S&T representative to the IIMG instructed the IMAAC to produce 
model runs that did not include the airplane dispersal. In the Connecticut JFO, decision 
makers sought plume products that assumed either an air release or a ground release, but 
not both. They wanted to compare the hazard areas of each because of the apparent 
uncertainty over the dispersal mechanism. In Connecticut and Washington. D.C., players 
reported being unclear on the role of the suspect plane in the chemical release. A clear 
statement from the IMAAC on the scientific verification of an aerial release may have 
helped alleviate such confusion.’^ 

Variation in inputs and requests may be a function of a lack of a common operating 
picture across the response organizations, or may be due to a real need for a different 
picture or focus. The concern for future applications of the IMAAC is the lack of detailed 
procedures regarding how to handle discrepancies, whom should be responsible for 
resolution and deconfliction, what authority or responsibility the IMAAC has to discuss 
the rationale for requests with a requesting agency, and how the IMAAC can more 
effectively inject scientific evidence into top officials’ discussions and decision making. 

5. Issues from Previous Exercises 

The most significant issue relative to agent confirmation and hazard area definition that 
came up in previous exercises was the presence of multiple, competing plume products. 
During the T2 FSE, the conflicting information provided in the many different plume 
predictions caused problems from the incident site all the way to the Secretary of 
Homeland Security. That experience led to the creation of the IMAAC and the MOA 
directing that the IMAAC serve as the single source for plume products. The result in T3 
was a more consistent picture of the hazard area shared across different operating centers, 
and a common plume picture shared by responders on the ground up to the HSC in the 


Confusion among participating agencies and operating centers regarding the role of the airplane in the 
mustard attack is discussed in greater detail in the Information Sharing chapter of the AAR. 
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White House. However, it should be noted that competing plume products in T2 were 
generated by FSL agencies. Although the IMAAC agreement appeared to reduce Federal 
products in T3 to those generated by a single source, the T3 FSE did not test potential 
complications from State or local agencies producing their own predictions. 

A second issue identified in T2 was minimal coordination of data collection efforts 
among agencies at the incident site. The result of the onsite coordination failures in T2 
was that no one agency at the site had all the sampling data and that many collection 
efforts were repeated. Onsite coordination of sampling in T3 seemed to go much better 
than in the preceding exercise, with the IC and FBI WMD Coordinator directing the 
initial sampling efforts, and the EPA, USCG, and CT DEP developing and implementing 
the follow-on sampling plan. The result was minimal redundancy in actual testing 
activities, except when required by exercise design. This improvement in coordinating 
sample collection efforts did not eliminate the broader T2 finding: no one agency had a 
complete operational picture. The same result occurred in T3, as evidenced by the 
contradictory requests issued to the IMAAC and the breakdowns in the flow of 
information about the contaminating agent. Similarly, although the onsite sampling 
activities in T3 appeared more coordinated, tension resulting from competing demands 
for access and duplicative capabilities suggests that coordination can be further improved. 

Finally, events in the T2 FSE illustrated problems with the distribution of analysis 
products to decision makers. Although there were some complaints during T3 about 
delays in receipt of products, they were not significant. For the most part, all of the 
operating centers and top officials had immediate acce.ss (via technical representatives 
and/or e-mail) to IMAAC products. Time delays could largely be explained by the chosen 
mode of receipt (i.e., download vs. e-mail) and how far removed an individual was from 
the initial distribution list. 

Table V-4 summarizes the improvements observed between T2 and T3 in the areas of 
agent confirmation and hazard area definition. Note that the T2 issues were those 
identified in that exercise’s AAR and may not be all inclusive. 
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Table V-4. Comparison of T3 FSE with Previous Exercises 


T2FSE 

SOE 05-3 

T3FSE 

tSSUES/OBSERVATIONS 

• Different agencies and jurisdictions used 
one or more plume models to generate 
predictions, which led to confusion and 
frustration among top officials in 
Washington State and Washington. D.C. 

• FSL agencies used different and 
incomplete data to develop plume 
products and deposition maps. 

• Decision makers did not understand the 
differences between predictive plume 
products, empirical data products, and 
deposition maps. 

• Decision makers were not well informed 
of the limited usefulness and lifetime of 
the plume predictions or the need to run 
updates using empirical data. 

N/A 

• IMAAC successfully provided a 
common picture of the plume for 
use by FSL officials. 

• IMAAC received inputs and requests 
that varied and/or contradicted with 
those received from other agencies 
or jurisdictions. 

• IMAAC received inputs and requests 
that would not produce a valid 
output based on scientific evidence. 

• FSL agencies/operating centers did 
not recognize the IMAAC products 
as a source for Information beyond 
predictive plume products. 

• IMAAC did not appear to have 
adequate procedures in place to 
deal with discrepancies In Inputs or 
contradictions in modeling 
requests. 

• Agencies at the incident site and at off< 
site locations did not coordinate 
collection and analysis of radiological 
data. 

• Officials agreed that rescue 
operations are always the top 
priority snd predicted that there 
would be no conflict between 
law enforcement, 
decontamination, and public 
heatth/medical response efforts. 

• Specialized Incident site response 
units did not exhibit a clear 
understanding of each other's roles, 
authorities, and standard operating 
procedures. 

• The lack of a formally defined 
information flow process from the 
Incident site resulted in premature 
public messages and decision 
making about the Identity of the 
chemical agent. 


• Some officials expressed 
concern about lab shortages for 
a widespread chemical release. 

• Officials emphasized the 
importance of summarizing 
technical Information in 
layman's terms to support 
dMision makers. 
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F. Recommendations 

• Clarify and disseminate the various response organizations' roles and 
responsibilities at the incident site, to include the timing of those responsibilities 
and their contribution to the larger response operation. 

• Clarify the formal information flow procedures from the incident site to the rest of 
the response organization and assert the authoritativeness of formal processes 
over informal information movement. 

• Clarify the IMAAC processes for receipt and review of other modeling products 
and establish a protocol for other modeling agencies to distribute to their 
consumers on the purpose of their product and the guidelines for redistribution. 

• Develop procedures on how the IMAAC should handle discrepancies in data 
inputs or product requests and identify a process to aid the IMAAC in 
deconflicting inputs. 

• Clarify the responsibilities, authorities, and mechanisms for the IMAAC to 
formally disseminate critical information learned through its scientific analysis of 
the incident. 
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VI. Emergency Response Operations under a Unified Command — 

Task # IV-2: Establish IC Unified Command 

A. Summary of Issue 

The issue is that the Unified Command’s scope of responsibilities was not clearly 
understood. Doctrinal details were insufficient regarding concurrent implementation of 
the NRP and NCP and regarding the resulting duplication of roles, competition for 
resources, and coordination of information. 

The National Incident Management System (NIMS) directs the Incident Command 
System (ICS) as the Federally recommended organization for managing emergency 
responses. It allows an integrated organizational structure that can scale up or down to 
effectively meet the demands of an incident regardless of the complexity of the situation. 
Traditionally, the most senior person present from the primary agency overseeing the 
local response acts as IC and handles the command and coordination function. When 
multiple organizations or jurisdictions have responsibility over aspects of the tactical 
response, a Unified Command may be formed to link organizations or municipalities 
together, provide a forum for integrated decision making, and enable a coordinated 
approach to incident response. 

The T3 FSE provided an opportunity to exercise the integrated ICS approach in 
Connecticut with the formation of a Unified Command. The exercise revealed: 

• poor integration between the off-site Unified Command Post (UCP) and activities 
at the incident scene: 

• challenges for integrating the Unified Command with other emergency response 
organizations and operating centers; 

• concern over lack of alignment between the NCP and NRP, which plays out most 
significantly at the Unified Command; and 

• limited understanding of the scope of Unified Command responsibilities. 

The analysis indicates that implementation of the Unified Command concept would be 
improved by further defining the roles and responsibilities of the Unified Command, 
developing standard operating procedures, and detailing these in the NRP and other 
supporting doctrine, such as NIMS. Additionally, the external information flow processes 
used by the Unified Command need to be reconsidered to ensure State and local 
coordination, particularly when the Unified Command’s focus shifts to Federal-to- 
Federal support and NCP responsibilities. 

B. Background 

NIMS codified the concept of the ICS and the establishment of a single IC or a Unified 
Command to oversee response operations. Per the NIMS, a single IC is used when an 
incident occurs within a jurisdiction with no jurisdictional or functional agency overlap. 
The IC has overall incident management responsibility. A Unified Command is 
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implemented when a response involves multiple jurisdictions or agencies, each with its 
own functional responsibilities for an aspect of the response. The Unified Command uses 
a collaborative approach to make decisions and establish priorities. In both constructs, the 
Command develops incident objectives, approves Incident Action Plans (lAPs), and 
approves resource requests. Figure VI-1 shows the notional organizational chart for an IC 
or Unified Command per the ICS. 

Figure VI~I. Notional Response Organization under the ICS 
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Per the NRP. the IC or Unified Command coordinates its needs through the local EOC as 
depicted in Figure VI-2. The exception to this model is a Federal-to-Federal response 
situation, in which the JFO provides direct support to the Federally established ICP/UCP, 
In that case, the NRP permits direct coordination of information between the ICP/UCP 
and the JFO. as indicated by the dashed line in Figure VI-2. 
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Figure VI-2. Notional Coordination Flow from ICP/UCP 


Fiek> Le««< Regional Level National Level 



An IC's focus is direct control of tactical operations. As the multijurisdictional or 
multiagency replacement for the 1C, the Unified Command’s purview is also tactical 
operations on scene and the response efforts related to management of the incident site. 
Traditionally, the local EOC handles all other local concerns that fall outside the response 
objectives established by the IC/Unified Command. 

The Unified Command concept is introduced in the NIMS as an alternative or transitional 
option from a single 1C. It is not given much consideration in the NRP, which only 
defines it as an option. 

The Unified Command is discussed in greater detail in the NCP, which establishes the 
coordinated FSL response to the accidental or intentional release of hazardous 
substances, oil, pollutants, and contaminants into the environment. A Unified Command 
is the designated response structure per the NCP. The dominant agencies in the NCP- 
driven response are the USCG and EPA at the Federal level, environmental agencies and 
health departments at the State level, and emergency responders on scene.^^ The NCP 
proposes the Unified Command as the: 

Basic framework for the response management structure. ..that 
brings together the functions of the Federal government, the Slate 
government, and the responsible party to achieve an effective and 

In situations in which the release involves private corporalions or facilities, the responsible parties will 
also be part of the response. 
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efficient response, where the [On-Scene Coordinator] OSC 
maintains authority.^* 

In a response managed under NCP authority, the Federal On-Scene Commander (FOSC) 
holds primary responsibility for directing response activities and coordinating efforts 
related to the detection and mitigation of the release. Except in limited situations, the 
FOSC is a regionally based official predesignated by the EPA or USCG. The State is 
usually represented in the Unified Command by its environmental agency. The notional 
organizational structure of the Unified Command in an NCP response is shown in Figure 
VI-3. 

Figure VI-3. Notional Unified Command in an NCP Response 


l l-ORTTNC n: V 



The supporting resources depicted in Figure VI-3 include two permanent elements, the 
National Response Team (NRT) and Regional Response Team (RRT). These two 
elements are responsible for planning and preparedness activities, and for providing 
advice and support in the event of an incident. NRT membership consists of 
representatives from USCG, EPA, FEMA, DoD, Department of Justice (DOJ), 
Department of Energy (DOE), U.S. Department of Agriculture (USDA), Department of 
Commerce (DOC), HHS, Department of Interior (DOI), Department of Labor (DOL), 
Department of Transportation (DOT), Department of State (DOS), the Nuclear 
Regulatory Commission (NRC), and General Services Administration (GSA). RRT 
membership consists of designated representatives from each of the Federal agencies 

U.S. EPA. National Oil and Hazardous Substances Pollution Contingency Plan, §300.105(e). 

UNCLASSIFIED 

This Document Contains Canadian and United Kingdom Information 

251 








AAR 


TOPOFF 3 


participating in the NRT, as well as State officials. If agreed on by the States, local 
government representatives may also participate. Regional representatives from the EPA 
and USCG co-chair the RRT, except during activation, when the chair is a representative 
from the agency providing the FOSC.’^ 

The RRT is the regional coordination element for NCP planning and implementation. 
During a response, the RRT advises and supports the FOSC by monitoring the situation, 
providing subject-matter expertise and recommending specific actions. The NCP calls for 
the FOSC to consult regularly with the RRT as appropriate. Incident-specific RRTs may 
be activated upon request from the FOSC, from any RRT member, or by the RRT chair. 
Such activation is likely if the incident exceeds the response capability of the FOSC, if it 
transcends State boundaries, if it poses a substantial threat to public health or the 
environment, or if it is a worst-case discharge as described by law. 

The authorities and responsibilities referenced in the NCP are required by section 105 of 
the Comprehensive Environmental Response, Compensation, and Liability Act of 1980 
(CERCLA), 42 U.S.C. 9605, as amended by the Superfund Amendments and 
Reauthorization Act of 1986 (SARA). Public Law 99-499 and by section 31 1(d) of the 
Clean Water Act (CWA), 33 U.S.C. 1321(d), as amended by the Oil Pollution Act of 
1990 (OPA), Public Law 101-380. Response actions undertaken via CERCLA and the 
NCP do not require declaration of an INS or a Stafford Act declaration, but rather have 
their own notification mechanism and funding stream. As a result, the FOSC has 
independent authority under the NCP to respond to HAZMAT incidents and initiate 
response activities. The FOSC has the authority to go directly to the Federal agencies 
identified in the CERCLA to request a.ssistance and resources in their respective areas of 
expertise. To obtain support not otherwise available under the NCP, the FOSC may 
request Federal assistance from DHS via the Federal-to-Federal support mechanism 
available under the NRP, 

The NRP and NCP acknowledge the potential for concurrent implementation. In the 
event that an NRP response is underway, the plans call for the FOSC to carry out his/her 
responsibilities under the NCP while coordinating with the FCO to ensure consistency 
with other Federal disaster assistance activities. The NRP contains two annexes that 
address concurrent implementation of the two plans: 

• ESF #10 — Oil and Hazardous Materials Response Annex, which applies when 
ESF #10 is activated; and 

• Oil and Hazardous Materials Incident Annex, which applies when ESF #10 is not 
activated. 


The FOSC is the Federal official pre -designated by the EPA or the USCG to coordinate and direct the 
NCP response, with EPA taking the lead for inland incidents (or those affecting inland and coastal areas) 
and USCG taking the lead for incidents occurring on or near the coast. In limited situations, another 
Federal agency may be identified as the lead and will designate its own FOSC. 
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Most INSs involving the release of oil or hazardous materials will include Stafford Act 
declarations and the resulting activation of ESF #10. In those situations, the FOSC 
coordinates NCP response activities with the Federal actions via ESF #10 and the ESF 
#10 Senior Federal Official (SFO) in the JFO Coordination Group. If the INS does not 
include a Stafford Act declaration, the agency leading the NCP response provides an SFO 
at the JFO through whom activities will be coordinated. Either way, the FOSC typically 
communicates with the SFO, who coordinates with the PFO and/or FCO. In both cases, 
the NCP-style Unified Command communicates with the JFO Coordination Group. The 
lines of connectivity between the Unified Command and JFO Coordination Group are 
illustrated in Figure Vl-4. The graphic does not illustrate the coordination effort between 
the Unified Command's General Staff and ESF #10. 

Figure VI-4. Connectivity Between UC and JFO Coordination Group During 
Concurrent NRP and NCP Implementation 
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C. Reconstruction 

At 13:20 on Monday, April 4, a truck exploded at the City Pier in New London, CT. 
Local emergency personnel responded to the incident site shortly after the explosion. At 
13:30. the New London Fire Chief arrived on scene and established an IC to direct a 
coordinated response of fire, police, and EMS personnel. As other agency representatives 
arrived on scene over the next two hours, they checked in with the IC to determine how 
best to provide support. At 14:20, the IC initiated activation of an off-site command post 
to be staffed according to ICS guidelines, with operations, planning, logistics, and finance 
and administration branches. Command and control formally shifted to a Unified 
Command at 16:55, and plans were made to move to the off-site UCP to be located at the 
National Guard Armory a few miles away from the incident site. At 19:45, the IC 
announced his demobilization strategy for local assets on site, determining that once all 
patients were treated, the initial responders would depart, the FBI would take control of 
the scene, and the Unified Command would transition to the off-site UCP. The last live 
victims were removed from the incident site at 20:00, after which EMS and local fire 
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personnel demobilized, and ihe FBI began selling up its crime scene. The Unified 
Command fully activated at the armory at 21:30 with a planning and objectives meeting 
of the principals. 

Concurrent to the response and ramp-up on site, other emergency response organizations 
at the FSL levels were activated. The New London EOC stood up at 14:02 and 
established communications with police officers at the incident site and with the Area IV 
Coordinator for the State. The Governor activated the State EOC shortly thereafter at 
14; 13. The FEMA Region 1 RRCC stood up at 13:50, while the JFO assumed control of 
Federal response coordination at 22:31. 

Figure VI-5 illustrates the key events in the ramp-up to a Unified Command. 

Figure VI-5. Transition from an IC to a Unified Command 
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The agencies represented in the Unified Command on April 4 were: 

• New London Fire Department 

• New London Police Department 

• CT State Police 

• CT DEP 

• CT DPH 

• DHS/USCG 

• FBI 

On April 5, Urban Search and Rescue (USAR) joined the Unified Command to 
coordinate its recovery operations at the incident scene. EPA joined to facilitate the 
assumption of responsibility for remediation of the chemical release. 

The Unified Command general staff was comprised of representatives from the USCG, 
EPA. CT DPH, U.S. Public Health, and NDMS among others. Figure Vl-6 shows the 
organizational chart for the UCP during the T3 FSE. 

Figure VI~6. CT Unified Command Organizational Chart as of April 5 



Once activated, the Unified Command’s focus turned to setting objectives for the 
response effort and planning activities for the upcoming operational period. Following 
the 21:30 strategy meeting, members drafted an lAP to start at 08:00 on April 5 that 
included an air monitoring and sampling plan to begin testing for the extent of the 
contamination. The lAP was approved at 06:30 on April 5, during the morning meeting 
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of the Unified Command. At that time, the FBI notified planners of the need to rework 
the sampling plan to account for site closure for evidence collection. At 14:30 that 
afternoon, HAZMAT units from EPA, USCG. and CT DEP notionally began executing 
their sampling plan in the neighborhoods around the incident site. Actual sampling efforts 
continued onsite until 14:36 on April 6, when the hazard area was fully understood and 
test results indicated greatly reduced concentrations of mustard. 

D. Consequence 

The Unified Command concept adds flexibility to an incident response by providing the 
construct for integrated decision making and coordinated operations. The response in 
Seattle, WA, during the T2 FSE resulted in the establishment of an onsite Unified 
Command; however, no detailed analysis of that organization was completed to allow 
comparisons with T3. Experiences in the T3 FSE .suggest additional clarification of roles, 
responsibilities, and processes is required to make the Unified Command a more effective 
participant in response efforts. 

The following areas were problematic for the Unified Command during the T3 FSE: 

• maintaining oversight and awareness of activities at the incident site: 

• integrating with the other emergency response operating centers; 

• aligning response efforts pursued under the authorities of the NCP with the NRP 
activities and structures: and 

• understanding the scope of its responsibilities. 

Maintaining oversight and awareness of activities at the incident site was an issue for the 
Unified Command for three key reasons. First, there was no formal process in place to 
share information between the incident scene and the UCP. Instead, the Unified 
Command relied on direct reporting from senior representatives of the agencies still on 
the scene. Second, agency presence and participation in the off-site UCP was 
inconsistent, particularly among agencies still operating at the incident site. Third, there 
appeared to be a lack of buy-in or understanding among all responding agencies as to the 
purpose and operating mechanisms of the Unified Command. These explanations indicate 
the need for full-time agency representation in the UCP and/or specific processes for 
moving information from the site to the command post and vice versa. More discussion 
and documentation of the Unified Command concept at the Federal level may help 
promote support for and understanding of the ad hoc field organization. 

Poor coordination between the Unified Command and the local EOC resulted in the 
virtual exclusion of the latter from the response effort and the use of alternate information 
flow processes for coordination with the State. This may have been partially due to an 
exercise artificiality, but there are also indications that the Unified Command's focus of 
effort may have contributed to the problem. During the T3 FSE, the Unified Command 
primarily used Federal-to-Federal coordination and its NCP authorities to meet its needs. 
The processes for those approaches do not require any action from or coordination with 
local authorities. The NRP needs to reconsider the information flow processes that are set 
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Up when a Unified Command implements the NCP and Federal-to-Federal support. As 
the alternative to the local IC, the Unified Command must also communicate with the 
local authorities and keep them apprised of the situation at the scene, even if their 
resources are no longer required. In particular, when an incident progresses beyond the 
capabilities of the local municipality and the State, and when the UCP is comprised of 
predominantly Federal agencies, there may be a tendency to bypass the local and State 
authorities; the Unified Command and State government need to make concerted efforts 
to keep local authorities involved in the response process. 

Although the T3 FSE did not appear to have any significant problems attributed solely to 
the concurrent implementation of the NCP and NRP, participants and observers 
expressed concern that current doctrine does not sufficiently address the potential for 
duplication of roles, competition for resources, coordination of information, and 
transition from an NCP-only response to a joint NCP-NRP effort. The NRP annexes 
associated with concurrent implementation of the two plans require clarification and 
additional detail in the areas stated above. Furthermore, experiences in the T3 FSE 
suggest that the relationship between the RRT and ESF #10 is unclear. Further 
clarification as to the role of the RRT and its relationship to ESF#10 is needed. 

Finally, efforts pursued by personnel at the UCP, objectives established by the Unified 
Command, observations made by data collectors and subject-matter experts, and 
comments by participants themselves indicate that the role of Unified Command is not 
clearly understood or sufficiently defined. Operators require a better understanding of the 
Unified Command’s scope of responsibilities and role in the response operation relative 
to the local and State EOCs and the JFO. 

E. Analysis 

The focus of the analysis section is the role of the Unified Command as it relates to: 

• the lack of integration between UCP and activities at the incident scene; 

• poor coordination with State and local operations centers; 

• concern about lack of alignment between NCP and NRP; and 

• poor understanding of the scope of Unified Command responsibilities. 

}. Lack of Integration Between UCP and Activities at the Incident Site 

Evidence suggests there was minimal coordination between the UCP and activities at the 
incident scene. Agency representatives to the Unified Command were not always present 
or available at the UCP, and communications between the UCP and the incident site were 
insufficient once the local IC left the scene and turned the site over to the law 
enforcement investigation. This led to ineffective and wasted planning efforts at the UCP 
and tension among some Unified Command agencies. 

For example, overnight on April 4, the DHS/USCG, EPA, and CT DEP drafted a site 
sampling and monitoring plan as part of the Unified Command’s first lAP. That plan 
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assumed the HAZMAT specialists would have access to the site the next morning. 
However, there was no FBI presence in the UCP overnight, and the agency 
representatives charged with drafting the plan were concerned about scheduling 
remediation activities without FBI input. They attempted to reach the FBI Unified 
Command representative at the JOC overnight, but without success. When the FBI’s 
representative to the Unified Command reviewed the plan on April 5, he informed the 
rest of the FSL agencies present that FBI control of the site would continue for most of 
the day, and sampling units would not be allowed to begin their on-scene efforts until 
evidence collection had concluded. Discussions about access to the site went to the JFO 
Coordination Group and PFO for resolution. 

Analysis suggests three possible explanations for the poor coordination between the UCP 
and activities at the incident site. First, there did not appear to be a coordinated process in 
place to share information between the incident scene and the UCP. When the UCP 
formally activated at 21:30 on April 4, the only agencies at the incident site were FBI, 
State and local police, and USAR. The FBI and USAR representatives to the Unified 
Command returned to the UCP a few times each day to give updates and check in with 
the other agencies, but they were not present for most planning meetings or to support 
lAP development. As part of pre-exercise planning, the Unified Command developed an 
information flow plan for moving information from the UCP to other agencies, but it 
does not appear that such thought was given to the incident site. Rather, UCP members 
seemed to assume that those agencies with personnel still at the scene would provide 
sufficient representation in the UCP to facilitate coordination. 

The second potential explanation for poor coordination between the UCP and site 
activities is that agency presence and participation in the UCP varied throughout the 
exercise. The local fire and police representatives stood down at 15:00 on April 5. when 
all emergency operations at the incident scene had concluded, and the departments had no 
assets still participating in the response. The State Police and FBI did not have personnel 
in place to staff the off-site UCP 24 hours each day. Instead, the FBI Supervisory Special 
Agent (SSA) for the incident site was dual-hatted as the FBI representative to the Unified 
Command. His responsibilities of managing the FBI efforts at the scene would not permit 
him to commit to a full-time presence at the off-site UCP. This was especially 
problematic, considering the FBI was the lead response agency once the local IC 
demobilized his assets and the response shifted from emergency efforts to evidence 
collection. Senior representatives from CT DEP, CT DPH, EPA, and DHS/USCG 
appeared to be present in the UCP throughout the duration of the response, and as a 
result, they drove the UCP efforts toward their focus areas. The UC anticipated the 
presence of other agencies on a full-time basis which did not occur. 

Finally, the coordination problems may have been the result of a lack of buy-in by all 
agencies to the Unified Command concept in general and the establishment of an off-site 
UCP in particular. There was disagreement about the need for an off-site UCP and the 


Other implications of this issue are discussed in the chapter on Agent Confirmation and Hazard Area 
Definition. 
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potential overlaps between its activities and those of other operating centers in the 
response. For example, the FBI SSA appeared to be surprised to learn of the existence of 
the UCP at the armory, expressing to a data collector his impression that “The UCP was 
at the JOC.” This reveals a lack of understanding about the scope of the Unified 
Command and about the difference between the JFO/JOC and the Incident Command 
Post, which is further discussed in a later section of this chapter. The Incident 
Management Assist Team (IMAT) composed only of Coast Guard members, was the 
driving force behind the organization of the UCP and UC staff. Several other agencies 
were invited to participate in the UC staff, but did not send representatives. 

2. Poor Coordination with Local and State EOCs 

Information about plans, activities, and resource needs did not filter up from the Unified 
Command through the local and State EOCs, as designed by the NRP. Instead, once the 
Unified Command stood*up, the New London EOC was largely excluded from the 
response effort. Interactions and communication between the State EOC and the Unified 
Command appeared to be primarily through agency representatives present in both 
locations or through the JFO. 

In accordance with the NRP, the ICP/UCP coordinate, through the local EOC. official 
state/local requests for Federal assistance as depicted in Figure VI-2. Prior to the start of 
the T3 FSE, the FOSC oversaw development of an information flow plan for the Unified 
Command that expanded on the NRP’s structure for both Federal-to-State and Federal-to- 
Federal responses. That plan called for a liaison officer in the UCP to serve as the 
primary point of contact with the New London EOC. The plan is illustrated in Figure VI- 
7. 

Figure VI-7. T3 Information Flow Plan, Designed by the Unified Command 
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Although the initial plan provided a means of communication from the UCP to the New 
London and State EOCs, the reality was that the New London EOC was largely shut out 
of the Unified Command’s response efforts, and information flow to the State instead 
went through State agencies represented in the UCP (e.g., CT DPH and CT DEP). This 
may be partially because the local EOC closed at 18:40 on April 4, almost three hours 
before the UCP fully activated. Therefore, the UCP was forced to bypass the locals from 
the beginning and to find alternative ways of moving information to the State. By the 
time the New London EOC reopened on the morning of April 5, the alternative 
information flow processes were already in place. 

A second potential explanation for the lack of communication and coordination between 
the UCP and the local and State EOCs may lie in the Unified Command’s focus of effort. 
When the IC turned over control of the site to the FBI, field activities shifted to evidence 
collection, and efforts at the UCP itself shifted to remediation planning. The FBI and 
State Police coordinated their evidence collection onsite, and the remediation efforts fell 
under both the Federal-to-Federal response category in the NRP and the EPA/USCG 
authorities of the NCP. As was illustrated by the dashed line in Figure Vl-2, in a Federal- 
to-Federal response, the NRP calls for the UCP to coordinate directly with the JFO. The 
NRP also requires direct coordination between the FOSC and ESF #10 in the JFO. Per 
the NCP, coordination of remediation activities with the State is meant to occur at the 
agency level, usually by the State environmental agency. It is not unusual, therefore, for 
that agency to serve as the conduit of information to the State’s leadership in an NCP 
response. All three of these docirinally established communication and coordination 
processes do not include direct links with the local EOC. This may have resulted in 
communication difficulties during the exercise. The result for the T3 FSE was that, while 
it would have been appropriate to inform the local EOC of what was going on, the 
Unified Command’s primary efforts did not require any action from the New London 
authorities, and allowed for alternative information flow processes per doctrine. 

It should also be noted that the New London EOC. as is likely with most local 
governments, does not have the personnel to provide liaisons with the State or Federal 
command posts/operating centers. During the initial stage of the response, the New 
London EOC was apprised of the situation and the actions being taken by the local police 
and fire department personnel on the scene and the 91 1 dispatcher. Once those elements 
left the scene and left the response effort as a whole, the locals had no formal 
representation anywhere in the response chain. The result was not just exclusion by the 
UCP, but also by the State and JFO. The situation was exacerbated in Connecticut by the 
lack of a direct line of communication between the local EOC and State EOC. Instead, all 
communications flowed through an Area Coordinator. The New London EOC made 
numerous resource and information requests of the State through the Area Coordinator, 
but responses were consistently slow or nonexistent. For example, a request for all-terrain 
vehicles took almost two hours to reach the State EOC, which responded that the request 
would take six hours to fulfill — well outside the needed response timeframe. Another 
example of poor communication between operating centers and the local EOC is the fact 
that the New London EOC learned via VNN when the Governor raised the threat level, 
declared a state of emergency, and issued the shelter-in-place advisory in New London. 
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3. Concern About Lack of Alignment Between NCP and NRP 

Limited evidence from the T3 FSE exists to suggest there were problems with concurrent 
implementation of the NRP and NCP. This evidence largely focuses on confusion over 
the role of the RRT, resource request processes, and information flow. This evidence, 
combined with concerns expressed by exercise participants and observers over the 
alignment of the two plans, suggests the need for clarification and greater detail regarding 
how the two plans intersect, how to better integrate NCP response mechanisms with those 
of the NRP. and how to better coordinate the response efforts. Although ambiguities in 
these areas may not have caused noticeable problems during the T3 FSE, they appear to 
be of concern to the responding agencies and therefore merit further consideration. 

a. Role of the RRT and its relationship with ESF #10 

The ESF #10 — Oil and Hazardous Materials Response Annex to the NRP— describes the 
relationships among the ESF #10, RRT, and FOSC as ones of support and coordination. 
But little detail is provided as to how this .support and coordination would occur. The 
annex states: 

• “During a response, RRTs deploy their respective agency response resources and 
provide assistance and advice to the Federal OSC(s).” 

• “During an incident, the RRTs coordinate with the NRT and provide support to 
the Federal OSC.” 

• "To the extent possible, support agency representatives to ESF #10 should be 
those personnel also assigned to the NRT or RRT(s).” 

• “Either the EPA or DHS/USCG Co-Chair of the RRT serves as the regional lead 
for the ESF [#101, depending upon which agency is primary agency,” 

• “The regional lead for ESF #10, in coordination with the OSC, consults the RRT 
for advice or assistance, and establishes appropriate mechanisms for the RRT to 
coordinate with the JFO during an incident as needed.” 

• “Upon identification of actual or potential releases of oil and hazardous materials, 
the regional lead for ESF #10 closely coordinates with the OSC(s) and the RRT 
(if convened) to develop and implement a response strategy.” 

These six statements represent all of the guidance that the annex provides regarding the 
relationship between the RRT and ESF #10. Yet the two teams are very similar on paper. 
They both include representatives from EPA and USCG, as well as any other agencies 
with responsibilities in oil and hazardous material releases. They both provide guidance 
and subject-matter expertise to the FOSC. ESF #10 alone serves as the coordination point 
for the FOSC to align NCP response activities with the rest of the Federal efforts, 
whereas the RRT connects NCP efforts on the ground with policy and strategy decisions 
by the NRT. 

The lack of understanding of and clarity on the role of the RRT caused confusion for the 
USCG FOSC in terms of reporting requirements and where to go to seek guidance. The 
FOSC was under the impression that he had to keep both the RRT and ESF #10 updated 
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on the situation — a dual reporting burden for his staff. Additionally, he was concerned 
with seeking technical advice from both organizations and potentially receiving 
conflicting guidance. A late afternoon conference call on April 4 between the ESF #10, 
FOSC, and RRT attempted to clarify the role of the RRT and the means of coordination 
among the three groups. The decision was made to integrate the RRT into the response 
process via the SFO in ESF #10. Despite this apparent resolution, uncertainty persisted. 
On April 6, the FOSC forwarded a request to the RRT, suggesting that it coordinates with 
ESF #10 to establish a panel of experts to advise the Unified Command on the 
environmental effects of mustard and the remediation requirements. This justification for 
the request was to reduce the reporting requirement and the possibility of conflicting 
recommendations. 

In fact, the FOSC in the T3 FSE had a triple-stranded reporting requirement — his internal 
agency chain, the NCP reporting chain, and the NRP strand. These three reporting chains 
are shown in Figure VI-8. The dashed lines represent points where the NRP Annex 
suggests there should be coordination. 

Figure VI-8. FOSC Reporting Chains During T3 FSE 



The lack of understanding on the role of the RRT and its relationship with ESF #10 
caused confusion. The activation of both the RRT and ESF #10 appeared redundant, 
which increased confusion, raised concerns over conflicting advice, and appeared to add 
to the FOSC’s reporting burden. 

b. Overlapping Funding Streams and Resource Requests 

The NCP implements the response authorities and responsibilities granted by the 
CERCLA. Agencies leading NCP response efforts have access to CERCLA funding and 
the authority to request additional Federal support as needed. NCP actions do not require 
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Stafford Act funding or approval by the FCO via the FEMA ARF-MA process. As a 
result, there is the potential for duplicate resource requests from the NCP agencies at the 
UCP and from the FEMA structure at the JFO, as well as the potential for the FOSC to 
direct Federal resources controlled by the FCO. The process in place to prevent such 
overlaps is UCP coordination via ESF #10, as discussed in the NRP annexes and 
referenced previously. The T3 FSE data reveal no specific examples of competition for 
resources between the FOSC and FCO or dual requests. However, requests for resources 
by the Unified Command under NCP authorities and under the Federal-to-Federal request 
process of the NRP did add to the confusion among the various operating centers 
regarding what assets were being requested, who was requesting these assets, and the 
status of those requests.^’ This suggests that coordination of resource requests by the 
Unified Command via ESF #10 either did not occur or was insufficient. Internal AARs, 
exercise observations, and comments to data collectors note the potential for problems 
and indicate that additional clarification of authorities and coordination mechanisms are 
needed for FOSCs and FCOs to avoid conflicts in directing Federal resources and to 
maintain awareness of each other’s resource requests. 

c. Coordinating Mechanisms and Information Flow 

The way the NCP was implemented in this exerci.se changed the information flow and 
coordination processes established in the body of the NRP. Figure VI-2 highlighted the 
basic principle of NRP information flow from the IC or Unified Command through the 
local EOC. to the Slate EOC. and on to Federal agencies at the JFO. Activation of the 
NCP inserts a different information flow process into the mix, from the Unified 
Command directly to the JFO. 

Figure Vl-9 applies the connectivity construct developed in the NRP annexes to the UC 
and JFO in Connecticut during the T3 FSE. 

Figure Vl-9. Connectiviiy Between the Unified Command and JFO Coordination 
Group in Connecticut 
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ThLs issue is discussed in greater detail in ihe Resource Allocation chapter of Ihe AAR. 
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The NRP annexes associated with NCP implementation with and without ESF #10 
activation are the only location in the former document where it indicates that the Unified 
Command should be coordinating and communicating directly with the JFO and JFO 
Coordination Group. The information flow process implemented during concurrent NRP 
and NCP implementation has too many points of connectivity between the UC and the 
JFO Coordination Group, while potentially excluding the local and State EOCs. For 
example, on April 5, the UCP made a direct request of ESF #10 to assist in the relocation 
of small businesses affected by the incident. This request did not go through the State 
EOC or the normal JFO route. The presence of so many nodes can lead to poor 
information control and could confuse the operating picture. 

4. Limited Understanding of the Scope of Unified Command's Responsibilities 

The focus of an 1C is direct control of tactical operations. As the multijurisdictional or 
multiagency replacement for an IC, the common assumption is that the Unified 
Command’s purview is also tactical operations on scene and the response efforts related 
to management of the incident site. Traditionally, all other local concerns fall to the local 
EOC. Neither NIMS nor the NRP specifies any change in the Unified Command’s 
purview in WMD responses; when a “site” may not be clearly defined or identified; when 
tactical operations may rapidly conclude; or when State and Federal organizations may 
play a larger role. 

Per the ICS and NIMS, IC/Unified Command are responsible for establishing priorities 
and objectives for the incident response. The IC’s focus in Connecticut was on treating 
victims and securing the scene. The response by emergency personnel involved medical 
triage, victim recovery and transport, verification of the presence and identity of a 
contaminating agent, and decontamination of victims and personnel. The New London 
Fire Chief supervised and directed local emergency responders and State and Federal 
assets in the relevant activities to meet these objectives. Once the emergency response 
concluded the night of April 4, the fix:us of the Unified Command shifted from 
emergency response to evidence collection and remediation. The Unified Command laid 
out its objectives in lAPs covering the planned activities over the next operational period 
(24 hours). 

Many of the response activities and support pursued by Federal and State agency 
representatives at the UCP appeared to go beyond tactical operations at the incident site. 
UCP representatives from the U.S. Public Health Service Commissioned Corps and the 
NDMS were involved in tracking victim numbers, resolving bed availability issues, and 
facilitating requests for Disaster Mortuary Operational Response Team (DMORT). 
Members of the UC developed a risk communications plan in case of an evacuation, and 
issued recommendations for the public to the State EOC and JFO with regards to outdoor 
activities. On April 6, the Unified Command established a new team in the Operations 
Section to evaluate Maritime Security (MARSEC) measures on commercial shipping and 
develop responses to adverse effects. 
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In general, the role of the Unified Command is not well understood in an NRP response 
effort. The Unified Command concept is introduced in NIMS as an alternative or 
transitional option from a single IC. But it is not given much consideration in the NRP. 
which simply defines it without explaining the transition from IC to Unified Command, 
the determination of membership, the coordinating functions, the avenues for conflict 
resolution among members, or the scope of its responsibilities. The lack of a clear 
definition of the Unified Command’s scope was apparent in the UCP activities in T3 and 
in comments from participants during and after the exercise. 

5. Issues from Previous Exercises 

Table Vl-I summarizes the observations from SOEs and the T3 FSE with regard to 
emergency response operations under a Unified Command. Note that the T2 AAR did not 
identify any issues with respect to response operations under a Unified Command. 


Table VI- J. Comparison ofT3 FSE with Previous Exercises 


SOEs 

T3 FSE 

ISSUES/OBSERVATIONS 

• OUicials expressed general concern about the 
concurrent implementation of the NRP and NCP. 

• Doctrinal details were insufficient regarding concurrent 
implementation of the NRP and NCP. and the resulting 
duplication of roles, competition for resources, and 
coordination of Information. 

• Activation of both the RRT and ESF #10 appeared to be 
redundant and complicated matters for the FOSC. 


• The Unified Command did not maintain clear oversight 
and awareness of activities at the Incident site to ensure 
effective planning. 

• Agencies in the Unified Command did not have full-time 
representation at the UCP, which hampered Integrated 
planning and coordination of operations. 

• Response operations pursued by the Unified Command 
bypassed the established information flow process 
through the local and State EOCs. 

• The Unified Command's scope of responsibilities was 
not clearly understood. 


F. Recommendations 

• Encourage members of the Unified Command to provide full-time representation 
in the UCP. 

• Establish clear procedures for information sharing and coordination between the 
UC at the Incident Command Post, the JFO Coordination Group, and state/iocal 
EOCs (separate from procedures for processing resource requests) 

• Develop standard operating procedures for concurrent implementation of the NRP 
and NCP that expand on the coordination methods identified in the NRP annexes. 
Include how to transition between an NCP-only response and a concurrent NCP- 
NRP effort. 
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• Clarify and document the role of the RRT and its relationship with ESF #10. 

• Expand the NRP to include discussion of the Unified Command, its scope of 
responsibilities, and interactions with other emergency response centers. 

• Expand NIMS to include more detail on the Unified Command. 

• Develop standard operating procedures for the Unified Command that detail the 
transition from a single IC, the determination of membership, the coordinating 
functions, the avenues for conflict resolution among members, the determination 
of location (e.g., offsite or on-site), and the scope of its responsibilities. 

• Develop criteria for an IC to use to determine the circumstances under which it is 
appropriate to stand-up a Unified Command. 

• Recommend position-specific Incident Commander training for all potential 
Incident Commanders. 

• Discuss the development of a National IMAT made up of interagency members, 
instead of a Coast Guard-only IMAT. 
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Part 6: Conclusions 

This section summarizes the primary issues or observations and recommended courses of action 
associated with each of the ten analysis topics. Next to each recommended course of action is a 
designation of whether this is a National Response Plan (NRP)-related issue, policy issue, 
procedural issue, planning issue, organizational issue, information-sharing issue, or public 
information issue. 

1. Homeland Security Advisory System (HSAS), State Threat Conditions, and 
Associated Protective Measures 


Issues/Ob-servations 

• Real-world and exercise elevations of the HSAS level to Orange and Red indicate that 
implementation of the HSAS is not systematic. 

• There does not appear to be a formal mechanism for coordinating, reporting, and tracking 
changes to HSAS and State threat levels and implementation of associated Federal, State, 
local (FSL), and private sector protective measures. 

• The absence of a mechanism for coordinating the implementation of protective measures 
can contribute to an uncoordinated response. 

• Unintended consequences of implementing HSAS Red protective measures are not well 
understood. 

• Officials in the T3 Full-Scale Exercise (FSE) used the HSAS and State threat conditions as 
a means of facilitating emergency response operations more than as a threat advisory 
system. 

• Inconsistent messages and little specific public guidance limit the value of the HSAS as a 
waming/advisory system. 

Recommended Courses of Action 

• Develop a formal process for coordinating and tracking implementation of severe (or Red- 
level) protective measures across FSL government agencies and the private sector. 
(Procedural) 

• Provide more specific guidance regarding actions recommended under the different color- 
coded threat conditions and link the levels to specific protective measures. (Infonnation 
Sharing) 

• Re-examine and refine the potential purposes of the HSAS: (1) public warning and 
advisory, (2) attack prevention, and (3) emergency response. (Policy) 
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II. Joint Field Office (JFO) Operations 









Ill, Resource Requests and Resource Coordination 


Issues/Observations 

• The use of multiple resource processes created uncertainty and adversely affected situational 
awareness. 

• State and Federal officials struggled with the implementation of the Federal resourcing 
process. 

• The role of the Department of Health and Human Services (HHS) Secretary's Emergency 
Response Team (SERT) was not well-defined or understood by participants. At times, the 
SERT duplicated functions performed by Emergency Support Function (ESF)-8 in the JFO. 

• Information about the status of resources was not readily available, and the process lacked 
transparency. 

Recommended Courses of Action 

• Develop a unified Federal emergency resourcing process that supports resource requests 
from the State under the Stafford Act and resource requests for Federal-to-Federal support 
under other Federal authorities. (NRP) 

• Provide States with a team of subject matter experts who are knowledgeable on Federal 
capabilities and the resource reque.sting process. (Organizational) 

• Document the mission assignment process more thoroughly in the NRP. (NRP) 

• Clarify the role of the SERT during emergencies. Consider using the SERT to augment ESF- 
8 at the JFO or deploying the SERT to the State Department of Health to provide subject 
matter expertise in identifying and requesting Federal medical support, (Organizational) 

• Make information about resource requests readily available, including what resources or 
capabilities were requested, who made the request, how the request is being funded, and its 
current status. (Information Sharing) 
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IV. Information Sharing 


Issues/Observations 

• Information systems used in T3 were largely stovepiped within agencies and/or response 
communities. 

• The vast number of operating centers negatively affected information sharing by increasing 
the scope and complexity of the problem. 

• The use of informal or alternate channels for sharing information caused problems by 
enabling circular reporting and bypa.s.sing authoritative sources. 

• The T3 FSE revealed a lack of uniform reporting guidelines and procedures for validating 
information received from secondary or tertiary sources. 

• Agencies and operating centers acted and made decisions on different information. 

• Situational awareness was not effectively shared across operating centers and agencies. 





Recommended Courses of Action 


• Support the development of interoperable information systems and/or a suite of emergency 
response/management applications that can be used across response communities. 
(Information Sharing) 

• Consider development of a DHS field operations guide that lists radio 
frequencies/preferences of federal, state and local responders to expedite the development of 
communications plans, (Information Sharing) 

• Assess the roles and responsibilities of each Federal operations center and consider reducing 
the number of operating centers, consolidating them, or co-locating personnel. 
(Organizational) 

• Require that reports of casualty numbers include a clear description of the information being 
conveyed. (Information Sharing) 

• Identify key terms that are likely to appear during a Weapons of Mass Destruction (WMD) 
response, standardize their definitions, and disseminate the information across the entire 
response network. (Information Sharing) 

• Establish mechanisms to update and disseminate new definitions during response 
operations. (Information Sharing) 

• Identify and define the overlapping essential elements of information (EEIs) required by all 
the response communities. (Information Sharing) 

• Establish specific reporting protocols and guidelines for all levels of government. 
(Procedural) 

• Identify the authoritative sources for EEIs and what EEIs should be included. 
(Organizational) 

• Identify an operating center at each level of the response to act as the “keeper of the critical 
information.” (Organizational) 

• Develop protocols for horizontal and vertical coordination (i.e., horizontally across one 
level of government and vertically between levels) to align the operational pictures 
developed and maintained by different operating centers and agencies. (Procedural) 






V. Stafford Act Declarations 


Issues/Observations 

• It remains unclear whether an incident with a non-explosive biological, chemical, or 
radiological weapon would fit the definition of a major disaster under the Stafford Act. 

• Other Federal programs may provide assistance in lieu of a major disaster declaration. 

• The Stafford Act provides for the possibility of exceeding the $5 million limit set for an 
emergency declaration; therefore, reaching that limit is unlikely to result in significant 
impacts on response spending. 

• Lack of detailed information to agency staffs on verbal approvals of presidential 
declarations caused initial uncertainty at the National Response Coordination Center 
(NRCC), Regional Response Coordinating Centers (RRCCs), and State Emergency 
Operations Centers (EOCs) in Connecticut and New Jersey. 

Recommended Courses of Action 

• Determine the applicability of a Stafford Act major disa.ster declaration to non-explosive 
incidents involving WMD, particularly those involving a large-scale bioterrorism incident. 
(Policy) 

• If these types of incidents do not fit the definition of a major disaster declaration, determine 
whether exemptions within the Stafford Act for Emergency Declarations and other Federal 
programs can result in an equivalent level of assistance. If they can, ensure that States are 
aware of them. (Policy) 

• If the Stafford Act major disaster declaration does not cover these types of incidents and 
equivalent Federal assistance is not available through other means, pursue legislation to 
address this problem. (Policy) 

• Until legislation is passed that would allow these types of incidents to receive the full range 
of Federal assistance provided under a major disaster declaration, identify other Federal 
programs that may be able to provide assistance, and ensure that States are aware of them. 
(Procedural) 


UNCLASSIFIED - FOUO 

This Document Contains Canadian and United Kingdom Information 

272 







VI. Emergency Public Information 


Issues/Observations 

• Numerous tools, prompted by lessons learned during the T2 FSE, were implemented in T3, 
including a Ready Room, National Incident Communications Conference Line (NICCL), 
and public affairs guidance. 

• FSL agencies used a variety of means to reach the public; made joint public statements; 
and actively worked to combat rumors, consistent with the NRP and Incident 
Communications Emergency Reference (ICER) guidance. 

• In New Jersey, public messaging occurred largely at the State level with little coordinated 
local visibility. Local top officials were more visible in Connecticut. 

• FSL agencies may still not be prepared to provide swift, accurate, consistent lifesaving 
protective action guidance to the public. 

• The operations of multiple Joint Information Centers (JlCs) were not always coordinated, 
and there wa.s no evidence of u.se of a Joint Information System (JIS). 

• DHS’ pre-exercise coordination with international participants may be a model for 
coordinating international incident communications in a terrorist attack. 






Recommended Courses of Action 


• Develop the mechanisms to prepare FSL top officials to provide swift, accurate, 
comprehensive, and consistent potentially life-saving protective action in a terrorist attack 
with time-sensitive implications such as the scenarios used in T3. 

• Develop a supporting concept of operations (CONORS) to complement ESF- 1 5 and Public 
Affairs Annexes of the NRP and the ICER, and to provide more specific operational 
implementation guidance for executing incident communications in the context of the 
NRP. 

• Consider using future exercises to further test/refine protocols (which could be documented 
in the CONORS), and educate stakeholder organizations on how incident communications 
coordination mechanisms, such as the NICCL, can be used to promote a common 
operational picture and coordinate message content when appropriate. 

• Expand NICCL to an audio/visual forum that allows collaborative tracking of the evolving 
facts and message points. 

• Expand DHS Public Affairs Guidance product to provide more specific message points, 
and consider linking it to NICCL updates. 

• Establish primary information sources early in the incident, such as the State hotlines and 
websites in New Jersey and Connecticut. 

• State governments should develop complementary incident communications plans for SNS 
distribution and work closely with all affected localities to ensure that the guidance to the 
public provided by localities is clear and comprehensive. 







VII. Integrating Responses to Incidents of National Significance: Public 
Health Emergency and the Stafford Act 


Issues/Observations 

• Neither the NRP or the HHS CONOPS provides sufficient guidance for coordinating 
assistance for incidents that are concurrently covered under a Stafford Act declaration and a 
public health emergency. 

• HHS does not have a detailed process for requesting and coordinating Federal-to-Federal 
assistance for public health emergencies. 

• The funding capabilities of HHS and the funding responsibilities of Slates and other Federal 
agencies are unclear under a public health emergency. 

Recommended Courses of Action 

• Clarify the process for Federal-to-Federal support for non-Stafford Act assistance in 
conjunction with a Stafford Act declaration. Determine whether the action request form- 
mission assignment (ARF/MA) process can be used to request resources under other Federal 
authorities and how to coordinate those requests with the JFO. (NRP) 

• Develop a transition plan for coordinating incidents that start under non-Stafford Act 
authorities, but later grow to include a Stafford Act declaration. (NRP) 

• Clarify the process for Federal-to-Federal support under a public health emergency. Include 
how HHS should coordinate with other Federal agencies, who is best suited for coordinating 
and tracking requests (e.g., HHS or the Federal Emergency Management Agency (FEMA)) 
and what responsibilities other Federal agencies have to report to HHS. (Procedural) 

• Clarify the funding capabilities and responsibilities of States. HHS. and other Federal 
agencies under a public health emergency. (Policy) 
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VIII. Strategic National Stockpile (SNS) and Points of Dispensing (PODs) 


Issues/Observations 

• The throughput of the real PODs fell short of the goal of 1 ,000 persons per hour, which was 
established in the New Jersey Mass Prophylaxis Manual. That goal was an important 
assumption behind the massive prophylaxis campaign adopted by the State. 

• Timelines for establishing and staffing additional (notional) State and Federal PODs were 
most likely not achievable. 

• The resources required to staff the nearly 400 State and Federal PODs were not identified 
and were probably unavailable in the given timeframe. 

• Propo.sed locations of the notional Federal PODs were problematic. Postal facilities do not 
appear to be good candidates, and the Health Resources and Services Administration 
(HRSA) Centers are privately owned, not government owned. 

• The plan to provide prophylaxis statewide evolved during the course of the exercise and did 
not appear to reflect a pre-planned and carefully integrated Federal and State response. 

• It is not clear that the Federal government has a strategy or plan for implementing its own 
system of PODs or for rapidly identifying and supplying staff to support State efforts in the 
event of a large-scale requirement. 

o Efforts to coordinate the Federal and Stale distribution systems were ineffective. 

o Federal and Stale PODs followed different standards of care, with Slate PODs using 
more rigorous and resource-intensive standards. 

• The use of fixed distribution sites as the sole approach to providing prophylaxis for a large 
number (millions) of people may be impractical. 

• Some combination of fixed sites and other means of distribution, such as those being 
developed for the City Readiness Initiative (CRl), could be necessary to reach large numbers 
of people. 

Recommended Courses of Action 

• Develop joint Federal and State scalable prophylaxis plans that address a requirement to 
reach very large numbers of people. Plans need to include a combination of approaches, 
including fixed sites and direct delivery of prophylaxis. (Planning) 

• Expand the prophylaxis/planning practices and tools developed under the CRI to include 
regions and cities not currently covered. (Planning) 

• Develop options and guidelines for conducting large-scale prophylaxis. (Planning) 

• Determine whether the Federal government should be prepared to operate its own POD 
system in the event of a major public health emergency. (Policy) 

• Develop Federal plans for quickly identifying and providing staffing resources to States to 
support large-scale prophylaxis implementation. (Planning) 
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IX. Agent Confirmation and Hazard Area Definition 


Issues/Observations 

• Specialized incident site response units did not exhibit a clear understanding of each other's 
roles, authorities, and SOPs. 

• The lack of a formally defined information flow process from the incident site resulted in 
premature public messages and decision making about the identity of the chemical agent. 

• The Interagency Modeling and Atmospheric Assessment Center (IMAAC) successfully 
provided a common plume picture for use by FSL officials. 

• The IMAAC did not appear to have adequate procedures in place to deal with discrepancies 
or contradictions in inputs or modeling requests from various agencies. 

Recommended Courses of Action 

• Clarify the various response organizations’ roles and responsibilities at the incident site to 
include the timing of responsibilities and their value to the larger response operation. 
(Organizational) 

• Clarify the formal information flow procedures from the incident site to the rest of the 
response organization and assert the authoritativeness of formal processes over informal 
information movement. (Information Sharing) 

• Clarify the IMAAC processes for receipt and review of other modeling products and 
establish a protocol for other modeling agencies to distribute to their consumers on the 
purpose of their product and the guidelines for redistribution. (Information Sharing) 

• Develop procedures on how the IMAAC should handle discrepancies in data inputs or 
product requests and identify a process to aid the IMAAC in deconflicting inputs. 
(Procedural) 

• Clarify the responsibilities, authorities, and mechanisms for the IMAAC to formally 
disseminate critical information learned through its scientific analysis of the incident. 
(Information Sharing) 
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X. Emergency Response Operations under a Unified Command (UC) 


Issues/Observations 

• The UC did not maintain clear oversight and awareness of activities at the incident site to 
ensure effective planning. 

• Agencies in the UC did not have full-time representation at the Unified Command Post 
(UCP), which hampered integrated planning and coordination of operations. 

• Response operations pursued by the UC bypassed the established information flow process 
through the local and State EOCs. 

• Doctrinal details were insufficient regarding concurrent implementation of the NRP and 
National Oil and Hazardous Substances Pollution Contingency Plan (NCP) and the resulting 
duplication of roles, competition for resources, and coordination of information. 

• Activation of both the Regional Response Team (RRT) and ESF-10 appeared to be 
redundant and complicated matters for the Federal On-Scene Coordinator (FOSC). 

• The UC’s scope of responsibilities was not clearly understood. 
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Recommended Courses of Action 


• Encourage members of the UC to provide full-time representation in the UCP. 
(Organizational) 

• Discuss the development of a National IMAT with interagency membership, as opposed to a 
Coast Guard-only IMAT. (Organizational) 

• Establish processes for regular sharing of information with personnel at the incident site 
when an off-site UCP is established. (Information Sharing) 

• Rework information flow proces.ses involving the UC to include the local and State EOCs, 
even when using Federal-to-Federal support or NCP authorities. (Information Sharing) 

• Develop standard operating procedures (SOPs) for concurrent implementation of the NRP 
and NCP that expand on the coordination methods identified in the NRP annexes, Include 
how to transition between an NCP-only response and a concurrent NCP-NRP effort. 
(NRP/Procedural) 

• Expand the NRP to include discussion of the UC, its scope of responsibilities, and 
interactions with other emergency respon.se centers. (NRP) 

• Expand NIMS to include more detail on the Unified Command. (NIMS) 

• Develop SOPs for the UC that detail the transition from a single Incident Commander, 
determination of membership, coordinating functions, avenues for conflict resolution among 
members, determination of its location, and scope of its responsibilities. (Procedural) 

• Develop criteria for an Incident Commander to use to determine the circumstances under 
which it is appropriate to stand-up a UC. (Policy) 
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Annex A: Executive Overview 


1. Introduction 

Top Officials 3 (TOPOFF 3) was a congressionally mandated, national counterterrorism exercise 
designed to identify vulnerabilities in the nation’s domestic incident management capability by 
exercising the plans, policies, procedures, systems, and facilities of Federal, State, and local 
response organizations against a series of integrated terrorist threats and acts in separate 
locations in the northeastern United States. 

The United Kingdom (ATLANTIC BLUE) and Canada (TRIPLE PLAY) conducted 
simultaneous, related exercises with overarching international exercise objectives to improve 
mutual respon.se and preparedne.ss against global terrorism. The three domestic scenarios were 
enhanced by incorporating events from the other two countries. The planning and execution of 
the three national exercises provided an excellent opportunity for international cooperation, 
networking of key responders, and sharing of information on each country’s concepts of 
emergency operations. 

The following report summarizes the preliminary findings/lessons of TOPOFF 3 and suggests 
remedial actions to address identified shortfalls. An official TOPOFF 3 After-Action Report 
(AAR) will be promulgated on September 30, 2005, providing a more extensive analysis of 
exercise actions against information recorded by exercise data collectors located at key 
emergency operation centers and exercise sites. 

Major sources supporting this review included: 

• Master Control Cell Interagency Hotwash 

• Connecticut and New Jersey Venue Hotwash Comments 

• United Kingdom and Canada Comments 

• After-Action Conference (AAC) Out-Brief (Player and Planner) 

• HSC Comments 

• DHS I-Staff AAR 

• IlMG/HSOC Comments 

• DoD Comments 

• T3 Quick-Look Report 

• Large-Scale Game (LSG) Quick-Look 

Exercise design, exercise play, and exercise review — the three major components of TOPOFF 3, 
were all cast in deference to the four major objectives of the Full-Scale Exercise (FSE): 

• Incident management : To test the full range of existing procedures for domestic 
incident management of a weapons of mass destruction (WMD) terrorist event and 
to improve top officials’ capabilities to respond in partnership. 
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• Intelligence/Investigation : To test the handling and flow of operational and time- 
critical intelligence between agencies in response to a linked terrorist incident. 

• Public Information : To practice the strategic coordination of media relations and 
public information issues in the context of a WMD terrorist incident. 

• Evaluation : To identify lessons learned and promote best practices. 

The issues presented here are divided into four broad categories: 

• topics related to Federal, State, and local coordination; 

• topics related to the execution of procedures detailed in the National Response Plan; 

• topics related to environmental considerations resulting from a WMD incident; and 

• topics related to international communications, coordination of response, and role 
responsibilities resulting from a WMD incident in the United States. 

All have been validated as concerns worthy of remedial aciion/effort by the sources above and, 
in most cases, multiple sources. 

The format used herein is: 

• Issue (presented in abbreviated, but recognizable, form) 

• Discussion (circumstances surrounding the is.sue) 

• Recommendation (actions suggested as remediation for identified problem) 

The collective of most of the resources listed above are posted on the DHS ESP portal in the T3 
library documents section. Additional information can be gained though review of these sources 
or by contacting the SLGCP Exercise Director. 
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II. Executive Summary Overview 

A. Federal. State, and Local Coordination Process 

1. Emergency Declaration Process 

Issue: Stafford Act declarations require comprehensive review. 

Discussion: Entitlement differences between “emergency” and “major disaster” are inconsistent 
when applied against a multiple WMD attack. 

Recommendation: Impose the more encompassing “major disaster” declaration for all 
significant terrorist events. 

2. Coordination of Strategic National Stockpile 

Issue: There was a perceived lack of coordination between FSL mass prophylaxis plans. 
Discussion: Rapidly rising casualty numbers required officials to develop an ad hoc process to 
augment State prophylaxis plans. 

Recommendation: Initiate interagency effort to examine existing SNS distribution plans. 

3. Coordination of Federal and State Medical Response Plans 

Issue: Perceived limitations exist relating to medical provider surge capability in response to 
WMD incidents. 

Discussion: Gaps in organizational plans related to deployment of medical personnel affected 
the response to the incidents. 

Recommendation: Initiate review of Federal. State, and local plans to validate medical surge 
capabilities. 

4. Homeland Security Advisory System (HSAS) 

Issue: Elevation of HSAS levels raised persistent que.stions, triggering critical time-consuming 
coordination hurdles. 

Discussion: Operational consequences of the elevation of HSAS conditions need to be balanced 
against general public perception/public good. 

Recommendation: DHS, in coordination with the HSC, should study the implications of revising 
the HSAS to align it more directly with the operational requirements surrounding the 
implementation of protective measures. 

5. Private Sector Integration 

Issue: Concerns were raised regarding communication between governmental and private sector 
organizations. 

Discussion: Reported informational disconnects between FSL governmental entities and private 
sector suggests a need to accelerate recognition of the private sector in U.S. HLS effort. 
Recommendation: Consider a more robust private sector integration strategy to facilitate full 
use of private sector resources in the national HLS effort. 
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6. Critical Infrastructure/Key Resources 

Issue: Concerns surfaced over compatibly of Federal and State efforts in applying protective 
measures for land, sea. and air infrastructure and transportation resources. 

Discussion: There appears to be inconsistency between Federal and State responses to the HSAS 
elevation as it affects Critical Infrastructure/Key Resources. 

Recommendation: Revalidate Federal and State protection plans, especially regarding the 
transportation sector. 

B. National Response Plan Issues 

1. Statutory Authority 

Issue: Concerns were raised regarding alignment of statutory authorities that predate DHS and 
the NRP. 

Discussion: Uncertainty exists whether NRP guidance has been fully integrated into Federal 
procedures that predate DHS. 

Recommendation: Conduct a review of all Federal statutes and agency response plans related to 
terrorist incidents and ensure the NRP guidance is fully integrated. 

2 . JFO/PFO Decision Making 

Issue: The level of effectiveness of the PFO in facilitating coordination between Federal and 
State government in question. 

Discussion: After-action assessment of exercise suggests a lack of understanding of the role of 
the PFO by key respon.se personnel at all levels. 

Recommendation: Direct enhanced NRP training for critical staffs (i.e., IlMG, HSOC). 

3. JFO Integration 

Issue: The PFO cell appeared isolated within the JFO. 

Discussion: Full functionality of the PFO within the JFO was not realized in the area of 
coordinated Federal/State/local (FSL) messaging and deconfliction of interagency policy. 
Recommendation: Further refine the definition of PFO roles and responsibilities. As necessary, 
review and revise the structure supporting the PFO and JFO. Develop/implement expanded staff 
training. 

4. PFO Selection Process 

Issue: The selection of a PFO already holding a key position within an affected region can prove 
detrimental to the response effort. 

DLscussion: The PFO selection process must compare the ramifications of having a qualified 
leader with existing relationships selected from the affected region with assigning a qualified 
individual from outside the region. 

Recommendation: Develop a decision matrix that weighs all the pros and cons associated with 
the PFO selection. 
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5. Incident Reporting Requirements 

Issue: The incident reporting process lacks standardization across the interagency realm. 
Discussion: The misalignment and/or misinterpretation of the vital information being passed 
among “top officials” provides senior leadership with an ill-defined operational picture. 
Recommendation: DHS to refine internal reporting process and lead a Federal coordination 
effort. 

6. Information Management Systems 

Issue: Shortfalls were evident in the information management processes used to support the 
response effort. 

Discussion: The Homeland Security Information Network (HSIN) was clearly underused. 
Recommendation: HSIN should be reviewed to consider its intuitiveness and user distribution. 

C. Environmental Issues 

1. Bio Watch Detection Timeline 

Issue: The Current Bio Watch as.sessment process is labor-intensive. 

Discussion: Improved Bio Watch monitors could possibly accelerate confirmative agent 
identification. 

Recommendation: Initiate an evaluation of existing technologies for automated bio agent 
detection. 

2. Bio Watch Monitor Coverage 

Issue: Coverage for high-risk areas is limited by the number and placement of monitors. 
Discussion: Bio Watch coverage is incomplete in areas evaluated as high-risk. 
Recommendation: Consider expanding the number of monitors and review placement 
strategies. 

3. WMD Contamination Management 

Issue: Common WMD decontamination and cleanup standards have not been adopted across the 
Federal, State, and local realm. 

Discussion: States and local jurisdictions affected will likely request Federal 
guidance/assurance. 

Recommendation: DHS should accelerate development of consensus-based standards. 

D. International Perspectives 

1. International Incident Management Communications 

Issue: Challenges were noted related to integrating domestic and international incident 
communications. 
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Discussion: The exercise demonstrated the importance of having the U.S. embassy serve as the 
focal point for international discussions, especially during a crisis response. 

Recommendation: Clarify the role of the State Department in support of the context of incident 
management, enhancing international incident management communications. 

2. Alert and Advisory Systems 

Issue: Uncertainty existed regarding each nation’s alert/advisory system. 

Discussion: The impact of U.S. HSAS changes has a cascading effect on many international 
issues. 

Recommendation: Establish a working group to review and integrate international 
alert/advisory systems. 

3. International Aviation Issues 

Issue: Exercise incidents resulted in numerous aviation is.sues related to transportation and 
commerce. 

Discussion: "How clean is clean?" remains a challenging question given dissimilar international 
protocols and procedures, especially with regard to aviation issues. 

Recommendation: Establish common international standards of “cleanliness” related to aviation 
during incidents of WMD terrorism. 
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III, Executive Overview Issues 

A. Federal, State, and Local Coordination 

1. Emergency Declaration Process 

Issue: The authorities, processes, and assistance eligibilities associated with Stafford Act 
declarations require a comprehensive review in the context of terrorism incidents, specifically 
bioterrorism. (Recommendations about amending the Stafford Act were offered in the 
evaluations of the TOPOFF 2(X)0 and TOPOFF 2 events. Although slightly different in nature, a 
fundamental shortfall in the Stafford Act has been identified for remedial action.) 

Discussion: The Stafford Disaster Relief and Emergency Assistance Act provides for two types 
of declaration, “emergency” or “major disaster.” These declarations result in different levels of 
Federal relief/assistance to State and local governments. Emergency declarations are available in 
any instance in which the President determines Federal assistance is necessary to supplement 
State and local efforts to save lives and protect property, public health, and safety, or to lessen or 
avert the threat of a catastrophe. Both the Connecticut and New Jersey T3 Full-Scale Exercise 
events met this definition. 

“Major disaster” assistance is available only for natural catastrophes or, regardless of cause, any 
fire, flood, or explosion, per 42 USC 5122. The Connecticut exercise scenario involving a 
vehicle-borne improvised explosive device met the requirements of a major disaster. The New 
Jersey biological exercise scenario did not meet this definition. During TOPOFF 3, after Stafford 
Act declaration requests were received from both governors, the president, following the 
statutory guidelines of the Stafford Act, declared a “major disaster” for Connecticut and an 
“emergency” for New Jersey. 

As a result the legal constraints associated with each declaration acted to define the support 
limits available to State and local governments. For example. New Jersey businesses were 
ineligible for the Small Business Administration’s disaster loan program until the Presidential 
Declaration of Emergency was amended. Other Federal disaster programs remained unavailable 
to New Jersey residents. The declaration in New Jersey actually made incident management 
more cumbersome for authorities and led to a public perception that New Jersey’s crisis was less 
important than the event in Connecticut. New Jersey’s public reaction was captured by the media 
and preceded official government messaging regarding this issue. 

Further, the authorities of the Secretary of Health and Human Services (HHS) under the Public 
Health Services Act have not been reconciled with those of the Stafford Act in response to a 
WMD event. 

Recommendation: Review the Stafford Act and propose an amendment to allow for a 
declaration of “major disaster” for all significant terrorist events. 
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2. Coordination of the Strategic National Stockpile 

Issue: During TOPOFF 3 FSE, the effort of the Federal government and the State of New Jersey 
to provide mass prophylaxis to the State’s entire population following the biological attack 
revealed notable shortfalls in effectiveness. The speed and scale of the challenge (i.e., to put 
medications in the hands of the affected population in a secure and timely manner) is clearly not 
being met fully by existing plans. 

Discussion: Shortly after New Jersey initiated its five-day SNS distribution plan, rapidly rising 
casualty figures prompted the Federal government to rapidly accelerate and augment New 
Jersey’s distribution plan. Staff from DHS, HHS, and New Jersey worked quickly to develop an 
ad hoc process to .supplement New Jersey’s planned distribution centers with additional Federal 
centers located in the most severely affected counties. This plan, relying upon the rapid 
deployment of large numbers of Federal health care workers and other Federal personnel with 
material resources, effectively reduced the distribution timeline to only two days. Some level of 
preliminary FSL planning occurred, yet few participants from that planning effort were 
completely satisfied with the outcome. Participants cited a number of concerns related to the 
overarching SNS. Included were; 

• the adequacy of State and local jurisdiction plans to make effective distribution on a 
massive scale; 

• the adequacy of State and local Jurisdiction plans to determine which segments of the 
population require prophylaxis; 

• whether the State and local jurisdiction plans have been exercised to ensure that mass 
distribution of SNS materials can be readily accomplished with State and local 
indigenous resources; 

• whether to provide priority prophylaxis to health care workers and responders; 

• the ability to provide targeted distribution strategies (e.g., intensive efforts to localize 
geographically by risk); 

• the optimal method to provide security for the supply convoys and distribution sites; and 

• whether the Public Health Security and Bio-terrorism Preparedness and Response Act of 
2002 funding increased SNS distribution capability at the State and local level. 

Recommendation: DHS and HHS should partner to initiate an interagency/intergovemmental 
effort to coordinate Federal and State plans for medical response planning for tasks related to the 
distribution of the SNS. 

3. Coordination of Federal and State Medical Response Plans 

Issue: The national health support structure was not engaged to obtain appropriate assistance in 
dealing with the catastrophic incident presented. 

Discussion: The status of the State and organizational plans as they relate to the deployment of 
medical assets in support of efforts of this magnitude, translates as a limiting factor in response 
efforts (i.e.. How can the numbers of potential personnel available to assist be maximized? and 
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How can their related operational readiness be assessed?). Appendix 6 of the NRP-Catastrophic 
Incident Supplement (CIS) defines deployment timetables and suggests template components for 
consideration in designing a State and local strategy to deal with large-scale crises. 

Planning factors relevant to this exercise were: 

• the availability of hospital beds and specialized care equipment for WMD victims; 

• the capability to rapidly transport both response resources to an incident site and large 
numbers of victims to health care facilities; 

• lack of decontamination capability for numerous victims prior to hospital intake; 

• inadequate personnel to rapidly triage, shelter, and treat large numbers of victims at 
receiving hospitals, as well as the inability to provide enough doctors, nurses, and 
medical technicians on-scene. 

Recommendation: DHS should initiate an aggressive effort to encourage all States to design 
medical surge strategies based on the templates and support mechanisms outlined in the CIS. 

4. Homeland Security Advisory System (HSAS) 

Issue: Reacting to changes of the HSAS Threat Condition during TOPOFF 3 presented 
participating international. Federal, State, and local officials with persistent critical time- 
consuming challenges. 

Discussion; HSPD-3, amended by HSPD-5. promulgated the HSAS as the primary framework 
for setting and communicating risk conditions and directing or recommending protective 
measures. Although the HSAS Threat Condition has been elevated to Orange on six occasions, it 
has never been elevated to Red outside of an exercise environment. Exercise activities have not 
clearly defined the ramifications of an elevation of the HSAS level to Red. 

During the initial hours of the exercise, officials spent an inordinate amount of time attempting to 
resolve the issue of elevating the HSAS Threat Condition to Red following recognition of 
confirmed terrorist attacks. These difficulties continued later in the exercise as senior Federal 
officials perceived that there could be negative effects from the State-mandated protective 
measures that were activated when the State’s threat condition was raised to Red. These 
perceptions should be explored and, if negative effects are likely, they should be addressed. 

Many complications surfaced during the exercise that impacted decisions about the elevation and 
reduction of the HSAS Threat Condition. There appeared to be insufficient understanding among 
the Federal departments and agencies about what actions each might take at Red — leading to 
unanticipated negative consequences when the decision to go to Red was made. The consensus 
of opinion suggests that DHS, in coordination with the HSC, should revisit the HSAS and align it 
more directly with the operational requirements surrounding the implementation of protective 
measures while assessing its utility as a public messaging tool. 

Decisions surrounding HSAS Threat Condition elevation was driven by the need to send a 
consistent and effective message to the public rather than the need to activate the appropriate 
protective measures required to prevent or mitigate the effects of further attacks. For example: 
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• Senior Federal leaders felt obliged to raise the threat condition to Red despite concerns 
about its effect on the response due to public expectations that the highest threat 
condition must be appropriate following an actual terrorist attack — “If not Red now, then 
when?” 

• The debate over HSAS Threat Condition elevations tended to be focused more on its 
public warning and public messaging purpose than on the evaluation of the appropriate 
protective measures required to prevent or mitigate the effects of further attacks. 

• As the exercise progressed, protective measures were increasingly de-coupled from the 
HSAS Threat Condition (e.g.. a set of proposed measures was alternately labeled 
“Orange Plus" or “Red Minus," without changing the proposed set, depending on an 
anticipated HSAS Threat Condition decision. 

Recommendation: The HSAS should be reviewed to consider aligning it more directly with the 
operational requirements surrounding the implementation of protective measures. Its utility as a 
public messaging tool should be examined to determine if disseminating the level of protective 
measures taken is properly interpreted by the public and elicits the intended response. 

5. Private Sector Integration 

Issue: Although TOPOFF 3 provided private sector organizations and associations a tremendous 
opportunity to test emergency response and business continuity plans in conjunction with 
Federal. State, and local response agencies, inconsistency existed in passing information between 
the government and private sector participants. 

Discussion: TOPOFF 3 marked a significant increase in the involvement of the private sector in 
the exercise process. The private sector was successful at gaining access to incident response 
channels, but they were less than completely successful at gaining accurate and useful 
information to satisfy their situational awareness requirements. 

The private sector owns 85 percent of the nation’s infrastructure and has the potential to play an 
enormous role in the response to a credible threat, or in support of the nation’s critical 
infrastructure after a terrorist attack. The U.S. government has committed to exercise and assess 
its ability to successfully communicate and coordinate with the private sector. Exercises such as 
TOPOFF 3 provide an excellent opportunity to identify the critical links between all levels of 
government and Critical Infrastructure/Key Resources sector-oriented private sector 
organizations required during the re.sponse and recovery from a WMD incident. 

Recommendation: DHS should expand communicalion/coordination efforts with private sector 
entities in future TOPOFF series exercises to include formalizing the Private Sector Cell 
prototype at the National Infrastructure Coordinating Center (NlCC). Permanent implementation 
would enable private sector representatives who have responsibility for the nation’s critical 
infrastructure and key resources to carry out their NRP-defined roles during an incident of 
national significance. 
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6. Critical Infrastructure/Key Resources 

Issue: Federal, State, and local governments and private sector entities encountered difficulties 
in coordinating the application of transportation sector protective measures to land, sea, and air 
arteries in response to changing HSAS Threat Conditions. 

Discussion: Federal, State, and local governments and private sector entities have made some 
inroads to develop protective measures corresponding to the HSAS Threat Conditions, with a 
specific focus on the Critical Infrastructure/Key Resources sectors identified in HSPD-7, 
“Critical Infrastructure Identification, Prioritization, and Protection.” The IIMG maintains 
detailed protective measures listings, mapped against key homeland security mission areas, 
which are updated following operational periods and exercise events involving a HSAS Threat 
Condition change. As DHS officials attempted to implement these measures in response to T3 
exercise events and threat condition changes, they found themselves in conflict with the 
measures that State authorities had also taken in response to threat condition changes. 

Protective measures taken by the transportation industry (State and private sector) across New 
Jersey in response to the declaration of HSAS Threat Condition Red were seen by IIMG analysts 
reporting to the IIMG as overly restrictive and potentially adversely affecting the provision of 
life-sustaining services and the national economy. Slate-initiated security measures, including 
such actions as closing all interstate highway traffic and banning most forms of travel; had the 
potential to increase the negative effects of the terrorist incident well beyond the benefits to the 
effort to contain the biological event. 

An example of the Federal and State governments working at cross purposes was the situation at 
the Newark International Airport. The Federal government considered the airport open and 
operational, while its non-Federal staff had been released from work by the acting governor’s 
threat condition Orange and declarations. As a result. Federal authorities anticipated that, in 
an actual event, the ability to deploy emergency assets could have been limited. 

Recommendation: DHS should initiate an interagency effort to re-examine and further refine 
the coordination of Federal and Stale plans for development and implementation of protective 
measures with a specific focus on the Critical Infrastructure/Key Resources sectors, especially in 
the Transportation sector. 

B. National Response Plan Issues 

1. Statutory Authority 

Issue: The NRP provides a framework designed to integrate and focus the entire nation’s 
capabilities. Concerns exist, however, regarding statutory authorities that predate the statutory 
authorities that established DHS and the operational constructs of the NRP. 

Discussion: Opinions differ regarding whether these pre-NRP requirements have been fully 
integrated, reconciled, or updated to reflect the role of DHS and the NRP. Many Federal 
departments and agencies have preexisting mandates, structures, rules, and procedures associated 
with national disasters and potential terrorist events that predate the DHS and NRP. 
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Recommendation: Consensus suggests that an interagency-wide comprehensive review and 
reconciliation may be needed for the various statutes, authorities, directives, policies, and SOPs 
that relate to the range of incident types described in the NRP. 

2. Joint Field OfTice/Principal Federal ORIcial Decision Making 

Issue: Despite the presence of a PFO at both exercise venues, after-action observations suggest 
coordination of information and operations between Federal and State governments did not meet 
the needs/expectations of each level. 

Discussion: During TOPOFF 3, the PFO in New Jersey experienced a number of instances 
where key decisions were made by Federal and State officials without the appropriate 
consultation and, typically, with negative results. The New Jersey PFO TOPOFF 3 AAR cites 
the following examples: 

“The PFO lacked involvement with the Point of Dispensing (POD) negotiations between HHS 
headquarters and the DHS IIMG. The IIMG sent down a compromised strategy, apparently 
negotiated with HHS and/or the State which allowed for the implementation of an unworkable 
and unrealistic Federal plan. 

The PFO was unaware until late in the exercise of several conversations between the governor's 
representative and the SLGCP regarding a number of issues (including coordinating HSAS 
Threat Conditions) being worked at the JFO.” 

In Connecticut, the PFO/JFO and State EOC interchanges were affected by the establishment of 
a “Unified Command Post” (UCP). The UCP was sanctioned under the Oil Spill Contingency 
Act. Additionally, due to assumed exercise constraints, the UCP was fully established and 
operational far earlier than it would have been had this been a real attack. As a result, 
activities/issues that would have stressed the layers of management (local, regional. State, etc.) 
were managed at the UCP. 

Although the role of the PFO is defined in the NRP, the actual process of its integration with the 
other participants at the State and Federal levels continues. Similarly, although there is still room 
for improvement in the communications infrastructure within the PFO cell, this problem is not 
principally the result of telecommunications shortfalls. The root cause of confusion about the 
PFO is most likely the lack of training and experience with the NRP for personnel staffing the 
key incident management nodes. Few of the exercise participants have sufficient actual or 
training experience in incident management under the NRP in response to large-scale terrorist 
attacks such as that in the FSE scenario. 

Recommendation: DHS should develop a Federal Incident Management Training Program to 
prepare its employees to support the structures and processes of the NRP during an incident. 
Currently available training programs do not sufficiently prepare the Federal incident 
management staff to perform their required duties under the NRP. DHS should develop a Federal 
Incident Management Training Program to train the staff of the HSOC, the IIMG, other DHS 
operations centers, and the deployable staff of the PFO cell to execute the processes and 
implement the support structures of the NRP during an incident. 
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The training program could be considered a potential “certification” function for assignment to 
selected key roles once the program matures. Aspects of this training should include: 

• classroom instruction, as well as supporting interactive, collective training opportunities; 

• curriculum linked to actually executing incident management under the NRP; 

• training on the information management systems; 

• focus on developing the staffs of the HSOC, the IIMG, the DLT, and DLT staff that 
support incident management, other DHS operations centers, and the deployable staff of 
the PFO cell; and 

• availability to appropriate interagency staffs who serve in DHS fixed or field 
headquarters cells. 

3. Joint Field Office Integration 

Issue: The current integration status of the PFO cell and its members within the larger JFO 
structure justifies an accelerated strategy. 

Discussion: TOPOFF 3 provided an opportunity to review the interrelated operations of the JFO, 
the PFO. and the PFO support cell. In some ways, the JFO operations conducted during TOPOFF 
3 were not fully realistic; the two JFOs were operational much earlier than could be expected in 
an actual event, sites had been preestablished and prepared in advance, and staffs were 
predesignated and had trained together with knowledge of the exercise’s operational scenario. 
The exercise designers accepted the introduction of these artificialities to achieve a few days of 
near-steady State operations by these entities within the confines of a four- to five-day exercise. 

Many exercise principals indicated the lack of clear distinction of the PFO as a separate entity 
from the JFO Coordination Group in organization diagrams. Additionally, the inclusion of the 
PFO in key JFO planning processes seemingly blurred the distinction between the PFO as an 
overarching strategic coordinator and the JFO Coordination Group as the managers of 
operational strategy. 

Despite the lack of resolution on these issues, the value of the PFO as the DHS Secretary's 
representative during an incident of national significance was validated by the clearly successful 
use of the PFO and the PFO support cell as the key DHS communications and coordination link 
in the field. The PFO successfully resolved potential conflicts with State and local authorities 
regarding threat condition announcements, risk communications, requests for Federal assistance, 
and protective measures in both venues. The PFO cell served a critical reporting function 
providing regular situation reports and answers to ad hoc requests for information. The value of 
these services was best illustrated when communications or coordination inadvertently bypassed 
the PFO. 

Recommendation: The roles and responsibilities of the PFO and the PFO support cell in regard 
to their integration with the JOC require further definition. Adjustments are possible within the 
parameters of documents such as the PFO and JFO SOPs and the deployment of the proposed 
Federal Incident Management Training Program recommended above. 
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4. PFO Selection Process 

Issue: The selection of a PFO for a particular incident can have a negative effect on the 
providing agency’s ability to perform its incident management responsibilities when that 
individual’s agency happens to play a key role in the response effort. 

Discussion: The DHS Secretary designated the USCG First District Commander as the PFO for 
the WMD event in Connecticut and the FEMA Region II Director as the PFO in New Jersey 
during the exercise planning process. The selection of these key regional leaders as PFOs 
effectively removed them from direct operational command of their normal responsibilities at a 
point in time when intelligence indicated that there were threats to their respective areas and, 
especially significant regional ports. 

Recommendation: Criteria should be developed for the selection of PFOs to optimize the utility 
of the selected official for the incident and to minimize the operational effects on the providing 
agency, DHS should consider the development of a decision matrix, including supporting agency 
input. 

5. Incident Reporting Requirements 

Issue: The current crisis reporting process is not standardized and. as a result, T3 was unable to 
establish a creditable operational “battle rhythm.’’ (The incident reporting/communication issue 
is a repeat topic from previous TOPOFF events.) 

Discussion: The collection and sharing of the information required to manage the multiple 
incidents in the TOPOFF 3 scenario significantly challenged the current information 
management process. Symptoms of this problem included: 

• officials assigned to a strategic planning role in the IlMG spending considerable amounts 
of time pursuing the answers to individual requests for incident information; 

• senior leadership from DHS arriving at key briefings with data that did not closely 
compare to that of other Federal agencies, de.spite efforts to coordinate the information; 
and 

• the misalignment of the data being reported in the HSOC with that reported at the State- 
level or in the simulated national media. 

These problems were identified in processes internal to DHS, as well as in cases where the 
department relied on interagency coordination. 

Recommendation: Improvements in this area should begin with efforts by DHS to further refine 
and define the internal reporting processes, followed by an effort to lead the coordination of 
interagency reporting. The remediation effort for this issue would build upon existing standard 
formats and procedures by: 

• clearly delineating agency responsibility for specific topic lines of information in the 
reports; 

• creating a suggested template to drive the generation of a more predictable “battle 
rhythm’’ to compel data collection requirements; and 
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• establishing a realistic cyclic schedule for the information dissemination process. 

A well-managed process that has the confidence of the leadership would potentially reduce the 
requirements for the multiple ad hoc requests for information that plagued the incident 
operations centers during the first days of the exercise. 

6. Information Management Systems 

Issue: DHS’ automation of its information management processes is not fully mature and did not 
meet participant information technology requirements. 

Discussion: Current DHS information management processes do not fully meet the department’s 
requirement to provide a common reporting process and incident management “battle rhythm;” 
provide a Common Operational Picture (COP); or provide the automated .support to fully share 
capabilities across the incident management environment. DHS can ensure that these four key 
elements of its information management process are fully developed and implemented in the 
near term. 

The Homeland Security Information Network (HSIN) expected to leverage and integrate the 
information available on a number of incident management networks, yet the system was 
identified as ineffective by exercise participants. Some of the issues with HSIN are noted in this 
excerpt from the draft New London, Connecticut, JFO TOPOFF 3 After-Action Review. 

All participants in the JFO understood the need for a coordinated mechanism to pass up-to-the- 
minute situation status. As per the [draft] JFO SOP. "The primary (Sensitive But Unclassified} 
SBU data circuit within JFO is the Homeland Security Information Network (HSIN) JFOnet.’f_ 
However, many responders either did not have access or were not properly trained on how to use 
JFOnet to either upload or access information. 

Similar problems were encountered at DHS headquarters. IIMG members preferred to use 
Microsoft Outlook to exchange information rather than the tools available in HSIN. As in the 
JFO in New London, this was because participants either had not been offered training or did not 
see the benefit of learning to navigate the HSIN. 

Recommendation: As part of the refinement of the information management processes outlined 
above. DHS should conduct a review of the operational requirements for incident management 
automation. The following is a partial list of some of the features that should be considered for 
an enterprise-wide Operations Management Suite: 

• an interactive, simple to use, but powerful web-based solution with an easy to use and 
straightforward user interface; 

• a uniform workspace with a robust emergency management application and a contact 
relationship manager; 

• a collaboration application with virtual meetings and secure communication; 

• a highly interactive, simple to use Geospatial Information System; 

• a robust content management and information database with interfaces to external 
authoritative references and key information sources; 

• tools that automatically connect real-time information and longer term collaboration, and 
create knowledge and historical records as a by-product; 
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• automated emergency response plans and decision support guides that prepopulate the 
incident workspace and management processes; 

• templates to promote standardization and consistency for all incident-related reporting 
and documentation; 

• functions that mirror the NIMS and ICS; and 

• interoperability with other Federal, State, local, or field emergency management 
information systems. 

The proposed system “should be designed for use by Operations Center desk officers as well as 
top level management, leaders, and decision makers [and] support all phases and levels of 
operations management providing a virtual community for DHS team members, partners, and 
stakeholders.” 


UNCLASSIFIED 

This Document Contains Canadian and United Kingdom Information 

A-16 





AAR 


FO R OFF I C I AL USE ONLY 


TOPOFF3 


IV. Environmental Issues 

A. Bio Watch Detection Timeline 

Issue: The current Bio Watch assessment process is too labor-intensive. Automated detection 
and/or signaling technology could reduce the time needed for confirmative agent identification 
by eliminating or reducing reliance on human interface. 

Discussion: The scenario for the TOPOFF 3 Senior Officials Exercise 05-02 (“Fierce Squall”) 
included a Bio Watch detection of Yersinia pestis (plague) in New Jersey. In the SOE scenario, 
the agent was identified within 36-60 hours of its release. Bio Watch detection was included in 
the TOPOFF 3 scenario as an inject, but its detection capabilities were not actually exercised. 

Bio Watch was evaluated by the EPA’s Office of Inspector General in March 2005. According to 
this evaluation, Bio Watch monitors could accelerate confirmative agent identification through 
improved technology, techniques, and/or procedures. 

There are currently various options that are being explored to increase the efficiency and breadth 
of coverage. Timelines for analysis depend on the specific biological agent, but Bio Watch 
currently anticipates detection and confirmation of the presence of agents within 36 hours of 
release. The system may detect a biological attack in time to allow for early diagnosis and 
treatment of victims' symptoms (detect-to-treat timeline), and shorter detection times would 
allow for preventive public warnings and enable better containment and treatment of infection. 
The survival rate from exposure to certain biological agents is higher when antibiotic therapy can 
be administered before symptoms appear, but after symptoms manifest, the survival rate 
diminishes significantly. 

Recommendation: The CDC, with support from the EPA, should lead a comprehensive 
evaluation of existing technologies for automated biological agent detection systems that are 
being developed by public and private sector entities. Sources to evaluate include: 

• DOE National Laboratories’ Autonomous Pathogen Detection System; 

• DOD Chemical and Biological Defense Program technology; 

• Oak Ridge National Laboratory’s SensorNet program; and 

• U.S. Postal Service’s BioHazard Detection System. 

The CDC and EPA should continuously reassess collection and analysis procedures to 
implement quicker, more effective techniques. Techniques could include: 

• analyzing samples through mobile laboratory units; 

• changing the Polymerase Chain Reaction (PCR) testing process to run primary and 
secondary lab analysis simultaneously; 

• exploring the use of alternate sensor technologies such as biological assays and laser 
fluorescence; 

• supplementing Bio Watch monitors with handheld detection devices; 

• incorporating less accurate real-time detection technology into monitors; and 

• if employing real-time detection technology, implementing an automatic laboratory alert 
through wireless devices. 
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B. Bio Watch Monitor Coverage 

Issue: Bio Watch coverage of high-risk areas is limited by the number and placement of 
monitors. 

Discussion: Although Bio Watch aims to provide coverage for a high percentage of a city's 
population, it is unclear whether current procedures for receipt and integration of Bio Watch 
capabilities (into established medical and laboratory surveillance networks) are effective. 
Monitors were originally distributed based on criteria specific to air quality monitoring, not 
biological agent monitoring. Sensors might be located at less than optimal heights, in locations 
with obstructed air flows, or spaced too far apart. 

Recommendations: EPA and CDC should conduct testing of Bio Watch monitors to measure 
the range at which they can detect each “Category A” biological agent in high-risk areas. EPA, 
CDC, and State and local agencies should determine the optimal placement of monitors for 
maximum coverage in a given area, taking into consideration factors such as height, air flow, 
environmental elements, security and access, pollution, meteorological data, and proximity to 
high-risk areas and other monitors. EPA and CDC should consider deployment of mobile Bio 
Watch systems to areas where monitors have been disabled or destroyed, or where credible 
intelligence indicates a possible biological attack, taking into consideration possible lack of local 
laboratories and consequence management plans. To test these capabilities, future exercises 
should be designed to include activities that would stress these systems to focus on their 

effectiveness. 

C. WMD Contamination Management 

Issue: The standards that will govern the decontamination and cleanup of public and private 
property contaminated during a WMD incident have not yet been universally adopted within the 
Federal interagency community. 

Discussion: Uniform national standards do not exist to determine how clean is “clean” in the 
aftermath of a WMD incident. Common decontamination and cleanup standards that will be 
applied to public and private property contaminated by terrorist use of a CWA or a TIC-based 
WMD have not yet been adopted within the Federal interagency community. The decision- 
making process and authority for determining such standards are inadequately defined and 
understood at all levels of government. 

During TOPOFF 3, the incident site in Connecticut was extensively contaminated by the terrorist 
use of HD (sulfur mustard), which was dispersed over a wide area near the city pier. Although 
the duration of the FSE did not include the environmental cleanup of this agent, issues that 
placed Federal, State, and local authorities at odds did occur especially around the concern of 
whether it was safe for citizens in or near the affected areas to disregard the order to “shelter in 
place” initiated locally. Government messages outlining recommendations regarding the level of 
contamination and its danger to the affected public were contradictory and presented a picture of 
confusion. 

States and local jurisdictions affected by WMD attacks will likely request Federal guidance on 
reliable standards. The policy challenge of mid- and long-term contamination management has 
been identified repeatedly in previous exercises, but remains unresolved. 
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Recommendation: DHS should sponsor an acceleration of effort to develop consensus-based 
decontamination standards (crisis and long-term exposure) for the anticipated chemicals, 
biological agents, and radiological materials that are most likely to be used in a WMD incident. 
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V. International Perspectives 

A. International Incident Management Communications 

Issue: International incident management communication channels used during the exercise 
were not fully coordinated with existing day-to-day international communication channels. 

Discussion: The international incident management communication channels were not fully 
integrated with normal condition communication channels during the exercise. The 
establishment of the dual communication channels created uncertainties and prevented 
development of a COP. The person-to-person communications that are the norm during routine 
operations were not as well-developed as agency-to-agency communications activated during 
crisis conditions. 

Also, there was uncertainty about when to call upon U.S. embassies to establish or coordinate 
communications between foreign government agencies and U.S. counterparts. Further, 
uncertainty existed regarding the role and responsibilities of the Department of State (DOS) 
during incidents of national significance (INS), as described in the National Response Plan 
(NRP) and National Incident Management System (NIMS). 

Recommendation: Develop a strategy to fully integrate international incident management 
communications channels with those used for routine communications. Develop a plan to 
improve users' expertise with international incident management communications channels. 
Delineate, disseminate, and test the role and responsibilities of the DOS during INS. 

B. Alert and Advisory Systems 

Issue: Exercise players were uncertain as to the implications of changes in each country’s 
alert/advisory system. 

Discussion: Lack of understanding of what actions and policies were executed during the change 
in the U.S. HSAS led to uncertainty about how Canada and the United Kingdom should react 
domestically. Similarly, changes in the United Kingdom’s alert system were not fully understood 
by the United States and Canada. 

Recommendation: Create an international working group to clarify how changes in the United 
States'. Canadian, and/or UK’s Threat/Alert levels affect each country’s security, alert status, 
and the ramifications of these different/increased levels. 

C. International Aviation Issues 

Issue: Recognizing that virtually any major domestic incident will have international 
consequences (i.e., travel, health, law enforcement, citizens traveling abroad), the exercise 
revealed complex questions specifically regarding aviation-related issues. 

Discussion: A recurring topic pertaining to international travel and trade during the exercise was, 
“//ow clean is clean?" An international consensus of opinion on this i.ssue does not exist. Air 
travel questions remain unanswered concerning the closing of airfields, aircrews refusing to fly 
into and out of contaminated areas that remain open, decontamination of the aircraft upon arrival 
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into foreign countries, quarantine of aircraft (which are owned by companies and not 
governments), and international procedures for handling potentially contaminated items. 

Recommendation: Establish a more clearly defined global protocol on aviation issues as they 
relate to both individual travel and economic trade issues during responses to incidents of WMD 
terrorism. 
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VI. Conclusion 


TOPOFF 3 FSE was an innovative, challenging, and highly productive exercise designed to 
stress the system and the agencies responsible for responding to a terrorist attack. The 
observations, assessments, and recommendations in this summary were garnered from a number 
of forums and were validated from a practitioner’s standpoint. 

As the largest and most complex counterterrorism exercise ever attempted, TOPOFF 3 FSE 
provided a tremendous opportunity for private sector participants and Federal, State, and local 
governmental organizations to test their procedures and push their agencies to their limits. Many 
D/As were successful in straining their policies and procedures, and identified potential shortfalls 
in the process. In addition, the exercise provided many important lessons regarding Federal, 
State, and local interagency procedures for communications and the integration of support 
measures. 

Because of the extensive data collection process and the effort to make TOPOFF 3 FSE findings 
both well-documented and traceable through a detailed reconstruction of the exercise events, the 
more detailed AAR currently in development should provide a baseline upon which subsequent 
TOPOFF and other counterterrorism exercises can build and be rigorously compared. 

This document has been drafted to provide key decision makers with an executive-level 
assessment of areas and issues that warrant immediate attention and improvement. The lessons 
derived from this exercise will be valuable to other States and localities as they work to train, 
exercise, and improve their response capabilities in support of our homeland .security. 
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Annex B: Intelligence Play 


I. Summary 

The Department of Homeland Security (DHS) made information sharing one of the four 
key objectives in the Top Officials (TOPOFF) 3 (T3) exercise. To ensure that information 
sharing was appropriately exercised, an Intelligence Working Group (IWG) was formed. 
The IWG defined and charted the real-world information sharing channels that presently 
exist. This enabled T3 planners to create preventable acts that could be put into play 
through streams of intelligence for analysts to evaluate and intercede if the assessment 
dictated. 

Real-world issues related to intelligence channels, di.sconnects, and other contentious or 
undefined areas in the intelligence community (IC) and information sharing arena that 
significantly impacted the T3 exercise were: 

• identification of systems used to contribute to and create a common intelligence 
picture; 

• validation of Interagency proces.ses for information sharing; 

• improvement of situational awareness; and 

• request for information (RFI) process. 

The following annex captures the planning process for the T3 IWG, reviews the 
intelligence portion of the Full-Scale Exercise (FSE), and identifies lessons learned in 
information and intelligence sharing. Throughout this annex, recommendations are 
offered as potential means to improve the handling and flow of operational and 
potentially time-critical intelligence and analytical products. 

II. Introduction 

A. Intelligence as an Exercise Objective 

To increase the participation of the IC in the TOPOFF exercises, DHS designated 
intelligence information sharing as one of four key objectives in the T3 exercise. The 
objective was to test the handling and flow of operational, time-critical information, 
intelligence, and analytical products. 

The integration of intelligence is seldom played at realistic levels in full-scale DHS 
exercises. Typically, intelligence is a tool used to stimulate play to test operational 
objectives. Intelligence summaries are produced in the planning process and injected by 
the control cell at specific times to drive operational decisions. 

In conjunction with the objective to test the handling and flow of operational intelligence, 
the T3 design team created preventable acts with which to confront the intelligence 
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sector, providing situations that, if assessed correctly, could be intervened or stopped. 
This intelligence play began 30 days prior to the FSE. 

B. Intelligence Working Group 

The T3 Intelligence Working Group Concept Paper identified the following functions for 
planning intelligence play: 

• Design a functional exercise intelligence architecture that allows for analyst play 
and the distribution of exercise intelligence through existing real-world 
intelligence channels. The intelligence architecture must ensure that exercise 
intelligence does not mix with real-world intelligence. 

• Allow participation of top officials; allow the appropriate dissemination of 
intelligence to State, local, and international exercise participants; and remain 
linked to the exercise scenario and the Master Scenario Events List (MSEL). 

• Develop T3 intelligence play injects and work with the exercise design team to 
develop realistic intelligence injects. 

• Focus on prevention and examine Interagency and international intelligence- 
sharing processes to ascertain terrorist threats, identify targeted critical 
infrastructure, and prevent terrorist attacks against the United States and its allies. 

The IWG developed an all-inclusive intelligence architecture that resulted in a 70-page 
document. It became not only a handbook for the exercise, but a handbook for real-world 
processes in Interagency information sharing that did not previously exist in any 
government publication. (*lnformation related to the classification and availability of this 
document is available through Ms. Sandra Santa Cosgrove, Acting Branch Chief, 
National Exercise Division, DHS/FEMA. at (202) 786-9594). 

III. Background 

A. Intelligence Architecture 

Since 9-11. improvements in information sharing have occurred largely due to informal 
practices such as analyst exchanges and issue-specific distribution lists. Doctrinal 
changes have also improved information sharing, including the U.S. Patriot Act, the 
Intelligence Reform and Terrorism Prevention Act, DCID 2/4 and 8/1, multiple executive 
orders, and memorandums of understanding on information sharing within the IC. Most 
members of the IC have either augmented an existing counterterrorism (CT) component 
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or, in some cases, created new ones. The primary counterterrorism centers within the IC 
are; 


• DHS Information Analysis and Infrastructure Protection (lAIP) 

• CIA Counterterrorism Center (CTC) 

• Federal Bureau of Investigation (FBI) Counterterrorism Division 

• Defense Intelligence Agency Joint Intelligence Task Force — Combating 
Terrorism 

Rather than discussing each department or agency in depth, the IWG looked at the 
intelligence functions to determine how the intelligence members worked together 
overall. Though terms vary, each department and agency has a process for which 
information is collected, exploited, analyzed, fused into products, disseminated, and used 
to support decision making. Decisions based on the best information available result in 
further requests for information, reprioritization of collection assets to gather more 
information and reallocation of efforts to meet new demands. Regardless of whether the 
data collected is satellite imagery or a passenger itinerary printout, it is collected because 
the data was deemed important. Thus, the cycle begins with planning and guidance that 
translates into tasks. 

This cycle of tasking, collection, analysis, production, and decision making occurs within 
all government and private organizations. When an issue such as homeland security or 
counterterrorism cuts across the missions of multiple agencies, the same intelligence 
process occurring within each organization must be repeated and applied to the Federal 
government at the aggregate level. In this case, the whole is greater than simply the sum 
of the parts. The T3 IWG used this cycle to describe the relationship between Interagency 
intelligence organizations as a way to avoid stove-piped discussions about a particular 
agency or department. 

The IWG agreed that the scope of the objective spanned beyond the statutory members of 
the IC. The objective required the examination of information sharing between different 
levels of government (Federal, State, and local); across different mission areas (law 
enforcement, homeland defense, homeland security); and between different roles and 
responsibilities (intelligence, operations, and decision making). 

B. Defining Exercise Intelligence 

The IWG proposed that the Homeland Security Operations Center (HSOC) act as the 
chief decision making venue, holding weekly briefings derived from the community 
representatives that reside at the HSOC. Other agencies were encouraged to pulse their 
internal processes, enabling their own decision makers to weigh in on the intelligence; 
however, the coordination would ultimately occur at the HSOC. 


UNCLASSIFIED - FOUQ 

This Document Contains Canadian and United Kingdom Information 

B-3 




AAR 


TOPOFF 3 


Based on the above architecture, the IWG implemented the following protocols: 

• Normal intelligence channels would be used when: 

o Secret level would be the baseline assumption, 
o Some intelligence might be at higher levels. 

o Tear lines would be encouraged for release to Canada and the United 
Kingdom (UK). 

• Distribution lists would stay true to real-world lists rather than “shot-gunning” all 
intelligence to all players. 

• The Secretary of Homeland Security would be requested to send a letter to the 1C 
departments and agencies (D/As) requesting participation in T3. 

• As DHS would be using a fictitious Universal Adversary (UA) (rather than the 
real-world actors in the FSE scenario), the IWG would provide UA data on 
various systems for the analysts to research as they would real-world intelligence. 

• White noise would be used to obscure the FSE and preventable act intelligence 
and force analysts to sort through a variety of message traffic. 

C. Full-Scale Exercise Intelligence 

Once the exercise architecture was established, the IWG identified intelligence indicators 
that could be created for each event in the scenario, together with associated data that an 
analyst would require to fully assess the intelligence. For example, the scenario stated 
that, at D-240, a UA terrorist network sent the precursor material from North Africa to 
Connecticut. The Department of Defense (DoD) IWG listed potential intelligence 
indicators such as UA members confirming that a shipment was underway. They also 
identified potential information gaps to the development group responsible for the 
generating the scenario — how was it transported, on what vessel, what is the cargo 
manifest list, crew list, port of entry, and so forth. 

Ultimately, the IWG scripted 42 injects providing vague indications and warnings to the 
events that would occur in the FSE. These injects would take the form of messages 
originating primarily from the national intelligence agencies and FBI. There was some 
debate over the assignment of date-lime-groups for these injects. According to the 
scenario, many events occurred as far back as D-4()0, yet exercise intelligence play was 
slated to kick off on March 7. The group decided that all injects predating March 7 would 
be released into real-world systems on Friday, March 4, and all other messages would be 
released according to their date-time-groups. In retrospect, the initial drop heightened the 
alert levels in many agencies and allowed analysts to piece together the threat stream 
more quickly than if the intelligence had flowed over a longer period of time. 

D. Preventable Acts 

The IWG created five “preventable” acts and sequenced them so that one act could be 
averted each week during the month of March. A small group consisting of DoD (JS J2 
and_^JORTHCOMX_^BL_^HS_JAIR_^nd_^nited_States_Coast_Gua|d_^USCG)jnet_on 
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October 14 to develop these vignettes — one to meet each agency’s objective. Exercise 
guidelines dictated that the preventable acts could not deviate from the FSE storyline and 
that the vignettes must not leak too much information about the FSE, thus threatening the 
exercise startup conditions prescribed for the venues. Finally, all proposed acts would be 
coordinated with the other members of the IWG and ultimately approved by the DHS 
exercise planners. 

The five original acts included: 

• New Jersey (NJ) - arrest of Fatima Barakah (the microbiologist who developed 
the Yersinia pestis weapon for the NJ terrorist cell) as she tries to leave the 
country 

The objective of this preventable act focused on locating Barakah and arresting 
her prior to her departure for Miami. The key training audience included the NJ 
Joint Terrorism Task Force (JTTF), NJ Slate Police. FBI headquarters. Customs 
and Border Patrol. Transportation Security Administration (TSA), and lAlP. 

• Connecticut - break-up of a support cell in Connecticut and arrest of their 
logistics coordinator 

The key training audience included the New Haven FBI Field Ojfice, Connecticut 
JTTF. and the Connecticut State Police. 

• NORTHCOM - break-up of a cell in New Jersey that was threatening to attack a 
military base 

The purpo.'te wai' to train NORTHCOM Counterintelligence Field Activity-West 
analysts who.'se mission n’o.y to fuse counterintelligence and law enforcement 
information to as.'sess threats to DoD facilities. 

• USCG - identification and interdiction of a vessel transporting terrorist materials 
The objective was to support the USCG requirement of a field training exercise in 
which their new Enhanced Maritime Safety and Security Team could conduct a 
visit, hoard, search, and seizure operation outside the 12 nautical mile 
international water line. 

• FBI - a credible threat stream used to trigger the FBI to deploy the Domestic 
Emergency Support Team to Connecticut prior to the start of the FSE 

The representatives left the meeting with initial approval from the exercise planners and 
agreed to meet at the Midterm Planning Conference in November with a draft of each act. 
They also agreed to hold a scripting conference at the Joint Warfighting Center (JWFC) 
in Suffolk, Virginia, where the IWG could complete the ground truth documents for each 
act and begin drafting intelligence injects to support each. 

E. Exercise Plan 

Having the architecture and preventable acts, DHS exercise planners requested an 
Exercise Intelligence Annex to the overall exercise plan. IWG members debated over the 
classification of the annex. One side argued that it should be vague and unclassified 
because the exercise control cell did not need to know the exact distribution lists and 
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product details of each agency. Others argued that the document should be written at the 
classified level simply because no such document currently existed. Such a document 
would provide enormous value to the community for real-world practices. The IWG 
decided to provide both products. An uncla-ssified version described the control elements 
for the intelligence play — RFI processes, MSEL tracking, and so forth (see Annex A). 
The classified document describing information sharing would become a de facto 
evaluation guide to how the intelligence play worked in the pre-FSE play. The classified 
version would contain daily battle rhythms for each organization, expected player 
products, and details on how the products are disseminated internally and externally for 
each agency. This product ultimately became the Information Sharing Concept of 
Operations (CONORS). 

F. Full-Scale Exercise 

There were several events that occurred during the FSE that had no intelligence injects to 
support. These included; 

• the fourth vessel en route to Canada; 

• Canadian border crossing after the terrorist landed in Maine; 

• lerrorist activities and plans revolving around Boston and New York; 

• FBI operational events occurring during the investigation (e.g., safe house raids, 
arrests); and 

• coordination of Virtual News Network (VNN) unclassified media reports with 
intelligence. 

With the exception of the vessel tracking, these events were not fully synchronized with 
the IWG. The vessel tracking ground truth changed over 20 times between February and 
the third week of March. As a result, the data required to generate maritime tracks was 
late and, during the FSE, conflicting reports confused players. 

Regarding VNN. intelligence injects were sent to the VNN scripters to coordinate media 
reports, but not vice versa. During the FSE, intelligence failed to gain visibility on what 
media would be reporting that day. 

Starting on March 4, the control cell injected 104 intelligence injects into real-world 
message traffic systems to real-world distribution lists. Most injects were released in 
classified channels; some were phone calls to operations centers; others were unclassified 
police reports. During the FSE, the majority of injects came from operations rather than 
intelligence channels. Over 200 inve.stigative messages were released primarily in law 
enforcement channels. In all, players produced 140 products, ranging from spot reports to 
threat warnings to information bulletins. These products appeared in morning situation 
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briefings, on National Counierterrorism Center (NCTC) Online (NOL), and on seven 
other exercise websites. ’ 

IV. Exercise Design and Artificialities 

Without a precedent, the group invented the vignettes, design, requirements, and player 
expectations right up to the start of the exercise. Mistakes were made, frustrations ensued, 
but, in the end, most (if not all) of the IWG participants felt that the process presented an 
extraordinary training and educational experience. The professional relationships formed 
and cross-agency education exceeded any internal training the planners had previously 
received. Recommendations to future T3 IWG planners for better facilitation are listed 
below. 

A. Intelligence Objectives, Design, and Expectations 

Intelligence objectives, design, and expectations need to be defined at the beginning of 
the process. Although information sharing was a defined objective — who, what, where, 
and how to accomplish it — were not defined. As a result, not all agencies were fully 
prepared to participate in the exercise, and levels of planning and player commitments 
varied. For example, the White House decision to host twice weekly SVTC meetings in 
March came two days prior to the intelligence STARTEX and caused participating D/As 
to drastically adjust their level of play. Furthermore, conflicting guidance on the level of 
participation was issued. As a result, insufficient time and resources during the planning 
phase was allocated. 

Recommendations: 


• Create a memorandum of intent from the DNI providing intent, mission, 
guidance, and objectives of the exercise and distribute to all IC leaders; formalize 
effort with a memorandum of understanding regarding planning and vet through 
all directors of the participating D/As. 

• Require early involvement by all agencies deemed vital to the exercise. 

• Identify player roles and expectations. 

• Establish clear planner/control roles and expectations. 


' IC websites included NCTC Online, DHS, Joint Staff J2, NORTHCOM J2, NSA, and NGA, SIPRNET 
websites included NCTC Online. DHS, Joint Staff J2, and NORTHCOM J2. Unclassified portals included 
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B. Leadership 

The IWG was headed by a civilian contractor and composed of D/A representatives, 
sometimes contractors, to represent government agency staffs. The chairman performed 
his function well, but lacked both the position and the authority to make commitments, 
issue tasks, or make final decisions affecting participating agencies. Also, the group had 
no senior leadership with the ability to obtain the commitment of organizations crucial to 
the planning for the exercise, the pre-FSE intelligence phase, and the FSE. The group 
also relied on a civilian contractor to provide continuity with other planning meetings. 
There were many lost opportunities to integrate intelligence play with the domestic 
venues, international activities, media play, and law enforcement operations. 

Recommendations: The IWG must be chaired by a senior IC official that is given full 
tasking and decision-making authority. This individual should: 

• Have an understanding of the IC. 

• Have a secure position, a position that allows this official to work this as a priority 
mission, rather than an additional duty (full-time commitment). 

• Chair all IWG meetings; issue guidance, direction, and tasks to the members of 
the IWG; and provide feedback to the IWG. 

• Attend venue, Interagency, and media meetings to ensure intelligence activities 
are integrated with other aspects of the exercise. 

• Provide updates to exercise directors of participating D/As. 

• Contact D/A directors regarding noncompliance or other issues. 

• Have a staff of two to three contractors to assist with administrative work and 
meeting attendance. 

C. Planning Requirements 

The planning of the preventable acts was done backwards. Three days before the 
intelligence phase of the exercise began, a final ground truth document was published. 
This document endured numerous versions, varied authors, and editing performed 
without full knowledge of the nuances resident in the document. Unfortunately, not all 
intelligence controllers started the exercise with the correct version, and, in many cases, 
were unaware that their versions had been superseded. Two weeks into the exercise, 
inconsistencies between the ground truth document and proposed injects were noted. 
Furthermore, several proposed intelligence injects contradicted the content in other 
injects. Immediate ad-hoc planning sessions were convened to de-conflict these 
oversights. 
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Recommendations: 


• The overall scenario must be locked prior to the first preventable act planning 
conference. 

• Background material (ground truth documents) must cover all details from “birth- 
to-death” and from “port to port.” 

o The IWG participants can help provide these details, 
o The same working group that develops the exercise scenario should also 
be responsible for writing the intelligence background material. 

• MSEL injects should not be created until these ground truth documents are 
complete. 

• All injects should be scripted and de-conflicted prior to the start of the exercise. 

• The only ad-hoc injects that should be allowed are corrective or explanatory 
injects. New venues or threat streams should not be introduced. 

D. International Coordination 

International intelligence partners were engaged outside of established, real-world 
channels. The CIA did not join the planning until January 2005, thus the CIA Chief of 
Station (COS) in partner nations was not aware of all discussions regarding exercise 
intelligence play and was not aware of all planned exercise activities. Additionally, the 
COS was not provided periodic updates so course corrections could be made eaily in the 
process. 

Recommendation: 


• Bring the appropriate DNl and CIA organizations into the planning process as 
early as possible. Make sure that all U.S. government entities are in agreement on 
planned activities prior to meeting with international intelligence partners. 

E, Control 

The Intelligence Control Cell (ICC) needs to be consolidated. When the group worked 
dispersed during the March 4-31 pre-FSE intelligence play, it was difficult to maintain 
visibility and control of injects, RFIs, and player status. During this period, the ICC was 
manned by a skeleton crew. As a result, coordination and collaboration was often chaotic 
and challenging. However, consolidating the Intelligence Control Group for the FSE was 
a success. 

Recommendations: 


• Maintain a consolidated ICC. Ensure representation from all participating D/As 
(USCG noted as missing in T3 ICC). 
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• Require additional systems for the ICC that the (Exercise National Military Joint 
Intelligence Center (the facility where the T3 ICC was located) could not provide: 

o More unclassified computers 
o NSANet 

o ARCView and ERDAS for NGA 

o IC2PXXX for Maritime Common Operational Picture display 
o Video Teleconference capability 

• Consider using USCG Headquarters, Transportation Security Operations Center 
(TSOC), or JWFC at JFCOM (or similar facility) to provide these capabilities and 
additional space in future exercises. 

• Create a hardcopy library of MSEL items and ground truth documents. 

Master Control Cell (MCC) operations during the FSE were completely divorced from 
intelligence play and the ICC. The classification limitations and lack of secure 
communications in the MCC prevented intelligence from supporting the FSE operational 
play. This was illustrated by DHS’ and NCTC’s reporting of “Nothing Significant To 
Report” in their morning updates. Many of these is.sues could have been avoided had 
intelligence injects to support the FSE been pre-scripted and approved by the MCC. This 
task was not accomplished because many of the operational events that occurred in the 
FSE were unknown and/or unavailable to the IWG (see Leadership section). 
Additionally, the MCC had very little .situational awareness throughout the FSE due to 
the lack of secure communications. 

Recommendations: 


• Integrate intelligence into the FSE and have injects pre-scripted. 

• Have established authority to shut down unintended player streams. 

• The MCC should be located at a secure facility such as USCG Headquarters. 
TSOC. or JWFC at JFCOM so that the ICC could be co-located with the MCC. At 
the very least, the ICC representative at the MCC would have connectivity with 
the ICC and the players in the intelligence and law enforcement communities. 

The RFI process for the exercise was broken. Players received different answers to 
identical questions, and were completely unaware of what answers were already out 
there. Despite repeated attempts to control the Interagency RFIs, there was no solution. 
Most of the issues identified were real-world issues, not exercise issues, therefore the 
discussion and recommendations regarding this issue are consolidated in the intelligence 
lessons learned section of this document. 

Some agencies disseminated injects to real-world customers, while others limited their 
distribution list to exercise players. For example, DoD’s Defense Attache Office elements 
initially did not pass cables to their UK and Canadian counterparts because they were not 
included on disseminated cables and were later instructed not to participate in the 
exchange. 
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F. Universal Adversary 


Although using a fictitious terrorist group involves more work upfront for the analysts in 
terms of studying and preparing analytical documents, there are legal concerns about 
using a real-world terrorist group or individuals. If the FBI or DHS receives a Freedom of 
Information Act request for a name of an individual or a group, they are required to turn 
over all documentation (including exercise inject material) that contains references to the 
group or individual. Additionally, using a fictitious group avoids the claim that the 1C is 
undermining analytical and operational objectivity regarding the named groups and 
individuals. 

However, the Central Intelligence Agency (CIA) asserts that the use of fictitious 
individuals and groups undercut their ability to provide robust support to the exercise and 
severely limits the exercise’s utility as a training opportunity for CIA analysts. The CIA 
routinely provides substantive analytic support to other exercises (e.g., DoD, White 
House, 1C, etc.) where real-world organizations are used. Analysts are able to draw upon 
years of experience working the particular intelligence problem, thereby enabling them to 
quickly produce high quality intelligence products in support of exercise play. 

Recommendations: 


• Resolve di.screpancy between FBI/DHS and CIA regarding the use of fictitious 
versus real-world information for exercise purposes. 

• UA should contain additional background data on individuals (i.e., credit and 
bank histories, publication lists (if appropriate), travel histories, National Crime 
Information Center hits, watch-listing data). 

• UA should contain additional data on terrorist groups (i.e., previously posted 
disseminated intelligence, open source news articles). 

• UA should be available to 1C analysts in the form of a database resident on 
INTELINK and available to State and local LE analysts as a database resident on 
INTELINK’s unclassified Open-source Information System. 

• Use photos of Red Team role players in terrorist dossiers where appropriate. 

V. Artificialities 

Intelligence artificialities included the following: 

• The exercise play of the Principals Commitlee/Deputies Committee/Counterterrorism 
Security Group process did not reflect real-world processes, making it difficult to 
draw conclusions about how this process actually works. The fact that many of the 
participants at these meetings were “role playing” the officials that actually hold these 
positions caused the behavior of participants to be driven by the artificial exercise 
environment. 
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• Few IC agencies dedicated a full team of analysts to exercise participation, so the 
real-world collaboration that would normally occur did not take place. Analyst 
play was not uniform across each agency, and those analysts that did participate 
were not equipped with the Interagency contact lists with which they are 
accustomed to working. 

• CSG and SVTC attendees noted that distribution did not flow in some cases, 
resulting in a perception of lack of D/A participation. In reality, all agencies had 
100 percent participation, resulting in this exercise artificiality. 

During the exercise, planners functioned as players in some agencies, and. in others, the 
players were provided exercise planning information. This resulted in several cases of 
player “cheating," and severely corrupted the integrity of the analytical component of the 
exercise. 

VI. Exercise Observations 

A. Key Issues 

Preliminary analysis revealed that not all agencies achieved the same level of situational 
awareness throughout the exercise. Information flowed, but the speed and degree to 
which it flowed did not meet exercise planners’ expectations. Moreover, the answer to 
the question of who owns the common intelligence/operating picture remains 
unsatisfactory, if not unknown. Two major factors quickly emerged as obstacles to an 
Interagency common intelligence picture (CIP)‘: systems used to gain situational 
awareness, and the process by which all agencies gain situational awareness. 

B. Systems Used to Contribute to and Create a CIP 

/. Dissemination Lists 

When controllers released intelligence injects over real-world systems to real-world 
distribution lists, agencies discovered real-world problems. For example, the TSA 
Intelligence Service realized that several agencies retained outdated addresses for this 
organization's predecessor in the Federal Aviation Administration. Also, changes to the 
DoD Automatic Message Handling System prohibited agencies from sending messages to 
some directorates within the DoD. 

2. Range of Systems/Programs 

There is a wide variety of databases and systems that intelligence analysts use to locate 
information. The Joint Worldwide Intelligence Communications System, Secret Internet 
Protocol Router Network (SIPRNET), and the unclassified Internet are three separate 

^ A CIP is defined as a picture that facilitates collaborative planning and assists all echelons (extending 
be^on^h^rimar^iTembeou)^h^C^(^chiev^>itiiatiOTia^wareness^^^^^^^^^^^^^^^^^^^^ 
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networks. The Homeland Security Information Network. NOL. Law Enforcement Online, 
and Joint Regional Information Exchange System are portals found on various 
networks.\Most agencies also host collaborative workspaces on their portals. The “pull” 
aspect in information sharing is extensive. 

Three problem areas emerged under the “too many systems” issue: 

• Awareness: Although the IWG “Infonnation Sharing CONOPS” details the 
products and places available to analysts in the CT community, analysts tended to 
“pull” from the systems and places they were familiar with. 

• Access: Most did not have access to NOL. Few in the IC had access to leo.gov or 
the jfo.net portal established for the FSE to access law enforcement reporting. 

• Accountability; NORTHCOM tended to rely on chat functions (Zircon and 
Internet Relay Chat, which did not necessarily report actionable intelligence and 
often resulted in time-consuming tasks to DoD analysts who chased down rumors 
and faulty information from chats. 

NCTC fully supports access and use of NOL and routinely approves access for 
individuals who meet the security requirements. However, the most significant factor that 
limited access to NOL, the issuance of an IC Public Key Infrastructure (PKl) certificate 
by the appropriate D/As, is primarily a problem that re.sides within those D/As. For non- 
IC members, NCTC is able to broker the issuance of IC PKl certificates for NOL users in 
an efficient and elTective manner. However, for 1C members, the issuance of these 
certificates is completely controlled by the individual D/A. 

As a result of these issues, the situational awareness within each agency varied depending 
on the reliance of its analysts on different systems. 

Recommendations: 


1. Scrub IC and Interagency distribution lists. 

2. Update lists to include NCTC agencies; promote and facilitate access to NOL. 

3. Educate and train chat operators on how to maintain quality control on 
information disseminated in the collaborative environments and ensure new 
intelligence is disseminated to support access by the wider IC audience. 

C. Interagency Process for Information Sharing 

/. Creation of a CIP 

Senior players often asked who owned the CIP and wanted visual displays of threat 
activities, from tactical events at the incident sites to strategic awareness of overseas 
reporting. Analysts throughout the community were frustrated over the requirement to 
contact each agency in order to piece together the picture. Often, analysts called the 
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exercise control cell or simulation cell rather than each other. Conflicting reports 
emerged in senior-level meetings. 

Although there were no straightforward recommendations on where an Interagency CIP 
exists, there were several observations on how the current system functions. Events 
during T3 may have highlighted how intelligence agencies can improve situational 
awareness. A CIP does not attempt to reject outside-the-box analysis, but, rather, to share 
assessments for utmost situational awareness and development. 

Recommendations : 

• Make improvements to analysts’ awareness of and access to the span of 
Interagency tools to “pull” intelligence. 

o Retain and maintain an Interagency Handbook for Information Sharing for 
training purposes. The classified document contains daily battle rhythms 
for each organization, expected player products, and details on how the 
products are disseminated internally and externally for each agency: DHS 
will revise the exercise document for real-world use. 
o Continue to promote access to NOL. 
o Continue analyst-to-analyst exchanges at operations centers. 

• Narrow the gap between operational information and disseminated intelligence. 

o Encourage collection and investigation organizations to directly assign 
reports officers to each collection group involved in the crisis management 
process and generate intelligence reports for immediate dissemination, 
o Encourage CSG representatives to communicate with their subordinate 
elements. 

o Review SVTC/CSG notes distribution list. 

o Disseminate DHS Combined Situation Reports to the IC (provides a broad 
overview of the situation on the ground to analysts and decision makers). 

D. RFIs 

The RFI process resulted in redundant questions, unanswered questions, and conflicting 
answers. There was no mechanism to cross-reference responses to RFIs between 
agencies, as each department or agency has different RFI processes internal to their 
organization. There are also two types of RFIs: operational RFIs (e.g., analysts' queries 
for more information based on reporting (What was the license plate on the car?)), and 
analytical RFIs (questions that require re.search and analysis and lead to collection tasking 
(What is the leadership profile of terrorist organization X?)). Our observations and 
recommendations focus on analytical RFIs. 

DoD uses the Community On-Line Intelligence System for End-Users and Managers 
(COLISEUM), an online database that requires all intelligence agencies within DoD to 
log their RFI and responses. DHS is moving towards Pantheon, a database built off of 
COLISEUM, but designed for DHS directorates. The FBI requires external agencies to e- 
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mail RFIs to the Directorate of Intelligence, Requirements and Collection Unit. NSA has 
an established process (known as National Signals Intelligence Requirements Process 
(NSRP)) that few followed due to lack of knowledge from player analysts (especially 
FBI) about how the process works, or a lack of the NSRP tool at player locations. Many 
RFIs were submitted to NSA through informal methods (phone calls or e-mails), which 
made it difficult to keep track of requests and respond in a timely matter. 

Internal to each D/A, the RFl process was mostly successful. The problem occurred when 
the ICC tried to control the answers and found that the real-world system, which the 
exercise was attempting to simulate, prohibited any control. 

Recommendations: 


• DDNI/Collection should form an RFI working group to review processes, 
systems, and provide recommendations for enhancing visibility of RFIs and responses 
to RFIs between D/As. 

o Consider establishing an RFl fusion center at NCTC. 
o Consider designing an RFI Exercise. 

• DoD/DHS should work to ensure that Pantheon and COLISEUM interface. Given 
that the two databases share architectures and support personnel, the lack of 
interoperability between the two is a policy issue vice a technological issue. 

• Educate new IC members and partners of NSA’s NSRP system and encourage 
them to work with NSA liaisons at their home locations. 

• Educate IC analysts about FBl/DHS RFI processes. 

E. Flow of Information between Incident Sites and National Intelligence Agencies 

In T3, the FBI stood up an intelligence component within the Joint Operations Center 
(JOC) as part of the Joint Field Office (JFO) (in accordance with the National Response 
Plan (NRP)) in each venue. During the planning process, DoD and FBI personnel 
struggled to identify the composition of the intelligence component, as the details are not 
yet defined in the NRP. Questions such as who sits in the intelligence component and 
how they integrate with national agencies and the JFO remain unresolved. Because the 
JFO was a new concept, the objectives were to determine the composition of the 
intelligence component, the communication requirements and flow, and the integration 
with the larger JFO. In addition, DoD intelligence players had difficulty identifying how 
the NRP intelligence component would complement or compete for resources identified 
in DoD homeland security plans. 
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When analysts deployed during the FSE to support the NRP, several communication 
channels failed. Examples of this include: 

• USCG did not have secure communications at the JFO. 

• The JFO in New Jersey did not have secure communications adequate for 
Interagency use. The JOC in New Jersey was initially located at the local FBI 
field office and later moved to Jersey City. The FBI field office maintained secure 
communications for the duration of the exercise. 

• The intelligence component in Connecticut had secure communications, but there 
was a requirement for PKI certificates that delayed analysts. The intelligence 
component was eventually managed by DoD due to lack of Interagency 
participation. Additionally, the JFO intelligence component was shut down early 
because DoD personnel found that integrating with the JOC was more effective. 

Recommendations: 


• DHS should develop a detailed plan for the intelligence component and 
information flow under the NRP. 

• FBI, CIA, DoD J2 Intelligence Campaign Plans, and others should work with 
DHS to define requirements for the intelligence component. 

• The Task Force concept should be considered. 

• DoD should review the NORTHCOM intelligence planning concepts for support 
to homeland security operations. 

• CONOPS should be developed for the JTF connectivity to JFO intelligence 
component. 

VII. Conclusions 

Throughout the After-Action Report (AAR), recommendations are offered as a potential 
means to improve the handling and flow of ojjerational, time-critical, intelligence and 
analytical products. These recommendations have been vetted through and discussed by 
members of the IC as represented by the IWG. Though all observations and 
recommendations are considered instrumental to improving intelligence and information 
sharing, a few recommendations stand out as critical. 

A. Creation and Maintenance of an Interagency Handbook for Information Sharing 

The purpose of this document is to provide analysts with updated information on the 
structure of the IC, on how intelligence and information flows through the various D/As, 
and the different RFI proces,ses employed by each member of the IC. It will serve as an 
instructional guide for analysts to gain familiarity with sister agencies and ideally 
enhance analyst-to-analyst exchanges. Currently, a draft copy of this handbook has been 
created and it has been shared with the IC. It will serve as a working document which can 
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change and adapt as the IC evolves. The DHS (Information Analysis) will serve as the 
coordination center for changes and updates to this document. 

B. Revision of NRP 

This revision would include adding a detailed plan for the intelligence component 
addressed in the current NRP and additional guidance on information flow, 

C. Establish Leadership, Participation, and Timeline Criteria 

The intelligence piece of the TOPOFF series would benefit from standardizing the 
planning process. In an effort as monumental as thi.s. the successes of this group must be 
effectively transferred to the planners of TOPOFF 4. 
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Annex C: Private Sector 


I. Summary 

Private-sector organizations participated in the Top Officials (TOPOFF) 3 (T3) exercise as 
partners with Federal, State, and local (FSL) government entities to test their combined ability to 
prepare for and respond to simulated biological and chemical terrorist attacks in Connecticut and 
New Jersey. The private sector’s participation in the exercise was extensive. Over 140 private- 
sector organizations — representing critical infrastructure sectors, industry associations, public 
works, faith-based organizations, and multinational non-governmental organizations — played 
from 450 locations across the United States. The exercise allowed these participants to test the 
roles defined for private-sector organizations by the National Response Plan (NRP) while also 
testing new coordination mechanisms, including Private Sector Liaisons and a Private Sector 
Cell at both the State and Federal levels. 

The T3 private-sector participants’ involvement in the exercise raised key issues capable of 
exerting substantial effects on public-private coordination during real-world events. The issues 
are identified and categorized as follows: 

• Prototype Private Sector Coordination Mechanisms 

• Public-Private Coordination and Communication 

• Testing Internal Emergency Response and Business Continuity Plans 

• Cross-Sector Coordination and Communication 

• Private Sector Planning 

• Volunteer and Donations Management Support 

This T3 Private Sector After-Action Report Annex captures the planning process conducted by 
the Private Sector Working Group. Private Sector Planning Group, and T3 Exercise Planning 
Team; provides an overview of and analyzes the private sector’s participation in the Full-Scale 
Exercise (FSE); and identifies significant observations and key issues captured by the 
participants during the conduct of the exercise. The body of this annex concludes with 
recommendations for improving the integration of the public and private sectors in order to 
prevent, prepare for, respond to, and recover from weapons of mass destruction (WMD) terrorist 
attacks. 

II. Introduction 

T3. the nation’s largest, most comprehensive domestic terrorism response and recovery exercise, 
offered private-sector organizations an unprecedented and unparalleled opportunity to test their 
current level of integration into the unified and nationwide structure for disaster response and 
emergency preparedness. The scope and extent alone of private-sector participation was 
unprecedented — approximately 1,200 individuals representing over 140 private-sector 
organizations played at 450 locations across the nation during T3. The participating private- 
sector organizations ranged from small businesses and local transportation providers to Fortune 
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100 corporations controlling major sub-sectors of the nation’s critical infrastructure, from 
individual public works to multi-million member business associations, from local faith-based 
organizations to multinational nongovernmental organizations. 

T3 also permitted FSL government organizations to exercise their mechanisms and procedures 
for coordination and communication with the private sector. FSL government organizations 
assessed the private sector’s roles and capabilities in the context of a realistic disaster scenario 
and gauged the resources that the private sector would need and could provide in order to 
respond to and recover from a large-scale WMD attack by terrorists. 

Private-sector integration is a key component of the emerging unified national structure for 
disaster response and emergency preparedness. According to one widely cited statistic, 
eighty-five percent of the Nation’s critical is controlled by the private sector. Thus, the National 
Strategy for Homeland Security states that the Federal government has responsibility for 
fostering “unprecedented levels of cooperation’’ between the private sector and all levels of 
government. Homeland Security Presidential Directive-5 emphasizes “the role that the private 
and nongovernmental sectors play in preventing, preparing for, responding to, and recovering 
from terrorist attacks, major disasters, and other emergencies.’’ The Directive further requires the 
Department of Homeland Security (DHS) to “coordinate with the private and nongovernmental 
sectors to ensure adequate planning, equipment, training, and exercise activities and to promote 
partnerships to address incident management capabilities.’’ 

TOPOFF 3 tested the plans, policies, and procedures defined in the NRP, and the NRP 
repeatedly highlights the necessity of private-sector integration. The preface to the NRP states 
that the implementation of the plan and its supporting protocols “will require extensive 
cooperation, collaboration, and information-sharing .... between the government and the private 
sector at all levels.”' 

The NRP includes two support annexes that address private-sector integration in whole or in 
part. The Private Sector Coordination Support Annex “(ojutlines processes to ensure effective 
incident management coordination and integration with the private sector, including 
representatives of the Nation’s Critical Infrastructure/Key Resources sectors and other 
industries.”^ The Volunteer and Donations Management Support Annex “describes the 
coordinating processes used to ensure the most efficient and effective utilization of unaffiliated 
volunteers and donated goods during Incidents of National Significance.”^ T3 private-sector 
integration was designed to test the coordination processes and mechanisms of these two NRP 
annexes. 


' NRP, p. i. 

^NRP. p. xi. 

^NR^Voluiitee^iK^onation|^^aiiagcnTen^iij)g()r^nnex^^O^^ 
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A. Purpose of the Private Sector Annex 

The Private Sector Annex fulfills the fourth overarching objective for T3; “Evaluation: To 
identify lessons learned and promote best practices.” The description and analysis in this annex 
are intended to provide a basis for more robust and realistic private-sector play in future 
TOPOFF exercises. More importantly, the intent is to identify lessons learned that may be used 
by Federal, State, Local, and Tribal (FSLT) government and private-sector organizations alike to 
improve their real-world, day-to-day integration into FSLT emergency preparedness and disaster 
response. The overall goal is to improve the nation’s ability to mount an effective, integrated 
public-private response to and recovery from a WMD terrorist attack. 

A second purpose of this annex is to facilitate the Federal government’s mandate for a 
meaningful critique of T3 private-sector integration, a critique that may be appropriately shared 
with the private sector. The NRP’s Private Sector Coordination Support Annex states that the 
Federal government “conducts after-action critiques of the procedures detailed in this annex with 
private-sector participants when they are exercised in national-level, DHS-sponsored exercises” 
and “shares such critiques appropriately with private-sector participants,” T3 was such a 
national-level, DHS-sponsored exercise. This Private Sector After-Action Report Annex is 
intended to serve as the basis for an appropriate T3 critique that will be shared with the private 
sector. 

B. Scope of Annex 

This annex addresses significant issues arising out of the design, planning, execution, and 
analysis of T3 private-sector integration. This annex does not purport to be a comprehensive 
review of the entirety of private-sector play in T3. This is not possible, in part because data 
collectors were not provided for every private-sector organization, nor were they specifically 
focused on the private sector in the T3 Master Control Cell (MCC). The unprecedented scope 
and magnitude of private-sector play was deemed in advance to be too great for comprehensive 
data collection to be effective. 

As is true of all T3 evaluations, this annex focuses on high-level issues involving the private 
sector’s emergency preparedness and disaster response coordination. It does not focus on 
individuals or even on organizations. In the few instances in this annex where organizations are 
mentioned by name or characterized in a way that may suggest their identity, doing so was 
necessary to provide adequate context for the issue being addressed or because the organizations 
are uniquely situated or have unique responsibilities in the nation’s integrated structure for 
disaster response and emergency preparedness. 

C. Objectives Guiding Preparation of Annex 

In addition to the four primary objectives detailed in the body of the T3 After-Action Report, 
private-sector integration was designed to fulfill two additional sets of exercise objectives. 
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The following are the objectives for T3 private-sector integration as determined by the Private 
Sector Working Group (PSWG): 

Intelligence and Information Sharing: 


• Exercise communications links with relevant government agencies. 

• Improve information sharing processes and capabilities. 

• Test the Federal government’s Protective Critical Infrastructure Information (PCII) 
program. 

Incident Management : 

• Examine private-sector emergency response and business continuity plans. 

• Gain and maintain situational awareness of an emerging event. 

The second set of objectives designed specifically for T3 private-sector integration was 
developed jointly by the DHS Office for Domestic Preparedness (ODP), Private Sector Office 
(PSO), and Infrastructure Coordination Division (ICD). These DHS organizations identified the 
following as the objectives for T3 private-sector integration from the perspective of FSL 
government: 

Intelligence and Information Sharing : 

• Explore options for integrating Federal govemment/private-sector decision making, 
incident planning, response, and recovery operations. 

• Evaluate information sharing, coordination, and dissemination between private sector and 
FSL agencies before, during, and after an incident. 

• Test the Homeland Security Information Network. 

• Test the new DHS/PSO/Federal Emergency Management Agency (FEMA) volunteer and 
donations website. 

Incident Management : 

• Test the infrastructure coordination mechanism of the NRP as a single U.S. government 
point of contact for incident response relative to privately owned critical infrastructure. 

• Delineate a course of action for private-sector engagement in the response and recovery 
mechanisms of FSL departments and agencies. 

• Explore the implications and economic impact to the private sector of short-, medium-, 
and long-term recovery aspects resulting from sustained threat levels and disaster 
recovery operations. 

These objectives guided the data selection, analysis, and reporting reflected in this annex. 
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III. Background 

A. Private Sector Play and Players 

Private-sector play during T3 focused on exercising the functional integration of FSL 
government’s coordination mechanisms and processes with the private sector's emergency 
planning and disaster response and recovery operations. The NRP identifies four summary roles 
in which private-sector organizations operate during Incidents of National Significance (INS): 

• Impacted Organization or Infrastructure 

• Response Resource 

• Regulated and/or Responsible Party 

• State/Local Emergency Organization Member 

One or. more often, several private-sector participants functioned in each of these roles during 
T3. The level of private-sector organizations’ participation in the exercise ranged from 
individuals operating from their organization’s offices to a corporate emergency operations 
center (EOC) and hundreds of employees notionally carrying out their responsibilities under the 
company’s emergency response and business continuity plans. 

T3 involved far more private-sector representatives of the nation’s critical infrastructure sectors 
than were initially expected. The PSWG initially hoped to have at least three of the nation’s 
critical infrastructure sectors represented and tested from among the following: transportation 
(trucking, rail, maritime). chemical/HAZMAT. real estate/commercial, energy (oil and gas), 
water, and public health. Ultimately, every one of the thirteen critical infrastructure sectors 
identified in the National Strategy for Homeland Security was represented by more than one 
player and was exercised during T3. Table 1 lists the industry and critical infrastructure sectors 
and subsectors and provides the total number of private-sector players that represented each one 
during T3. 

In order to be approved for play, all private-sector participants were required to complete a 
Player Fact Sheet^ and submit it for approval to the T3 planning team. Private-sector players 
were also required to provide a written commitment to communicate exercise-related 
information according to the protocol defined in the T3 Private Sector Coordinating Instructions 
and to provide a minimum of one page of feedback after the exercise. 

B. Planning and Training Considerations 

To ensure that T3 was properly designed and executed to account for the specific and unique 
characteristics of the private sector, two private-sector groups were formed for the exercise 
planning process: the PSWG and the Private Sector Planning Group (PSPG). The PSWG was 
composed of all T3 private-sector participants, as well as the private-sector planners from DHS 
and the states of Connecticut and New Jersey, as well as the members of the Exercise Planning 

^h^la^e^ac^hee^bnTnj^i^ggendi)^^h^^^Wvat^ect^^ntegralio|^once£^^£erations^^^ 
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Team responsible for private-sector integration. Each of the three venues — Connecticut, New 
Jersey, and National — had its own PSWG. Each venue’s PSWG met approximately once a 
month from September 2004 through February 2005 to disseminate information to the private- 
sector participants and to generate and capture relevant ideas for the continued planning and 
execution of T3 private-sector integration. 

The PSPG, by contrast, was composed of only those private-sector participants in T3 who were 
designated by their organizations as T3 planners. Planners were required to attend a one-day 
training program for T3 field controllers and data collectors that was held in Connecticut, New 
Jersey, and Washington, D.C., during the weeks leading up to the T3 FSE. The PSPG was far 
smaller than the PSWG becau,se private-sector organizations playing in the private-sector 
Tabletop Exercise (TTX) mode' were not required to have a planner. About 100 private-sector 
participants elected to play in TTX mode. The approximately 40 representatives of private-sector 
organizations who were members of the PSPG were granted access during the T3 planning stage 
to the draft scenario and Master Scenario Events List (MSEL). They also provided and reviewed 
proposed events (injects, expected player actions, and requests for information) for the MSEL. 

ODP exercised final decision-making authority over all questions and design issues affecting 
private-sector integration. In addition, the DHS PSO and ICD were heavily involved in the 
design, planning, and execution of T3 private-sector integration. Among other efforts, the PSO 
and ICD attended PSWG and PSPG meetings; reviewed the draft exercise scenario; proposed 
private-sector-specific injects, expected player actions, and requests for information for the 
MSEL; and facilitated key relation.ships with and participation by private-sector organizations. 
The ICD Nice director and his staff planned and provided all of the logistics and other support 
for the Private Sector Cell co-located at the NICC during the FSE and planned and hosted a T3 
private-sector planning meeting in February 2005 and the dry run for the NICC Private Sector 
Cell. 

IV. Exercise Design and Artiflcialities 

This section de,scribes selected private-sector-specific exercise design considerations and 
artificialities that had a substantial impact on private-sector play in T3. T3 private-sector 
integration was designed to accommodate characteristics of the private sector that are distinct 
from most FSL government organizations. Relatively few private-sector organizations and 
personnel have emergency preparedness and disaster response as their primary responsibility. 
Before 9/1 1. relatively few private-sector organizations engaged in disaster response exercises 
involving substantial interaction with FSL government organizations. Similarly, although many 
private-sector organizations have well-defined plans for emergency preparedness and business 
continuity, far fewer have clear, well-defined roles and responsibilities for interacting with FSL 
government during a disaster response. 


^ The four private-sector-specific inodes of play are defined and described more fully below under the 
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It thus was determined during the exercise planning stage that private-sector integration should 
be designed to flexibly accommodate the various levels of time, personnel, and exercise 
experience each individual private-sector organization could commit to T3. Flexible modes of 
play and flexible hours of play were two key features designed to accommodate T3 private- 
sector integration. 

An exercise artificiality is a feature of the exercise that could not be played true to reality or 
freely scripted. Artificialities generally are limitations or constraints on the exercise design. The 
following artificialities were chosen based on multiple factors. In some cases, the artificiality 
would not have occurred in a real-world situation; in others, the artificiality was noted because it 
had a substantial overall impact on exercise play. These artificialities influenced both the 
exercise design and the conduct of players throughout the exercise. The overall evaluation of the 
design and execution of T3 private-sector integration should be conducted with an understanding 
that these artificialities, and others, existed. 

A. Flexible Modes of Private Sector Play 

Each participating private-sector organization selected and played in one of four modes designed 
specifically for private-sector integration. The four private-sector play modes are: 

• Tabletop Exercise (TTX) 

• Command Post Exercise (CPX) 

• Closed Loop Exercise (CLX) 

• Full Scale Exercise (FSE) 

The extent of private-sector organizations* play ranged from notional participation by a few 
individuals (TTX) to full-scale, on-the-ground involvement (FSE), Each private-sector 
organization worked closely with the exercise planning team for the venue in which it was 
playing (Connecticut, New Jersey, or Interagency) to determine which play mode would be the 
most appropriate for that organization. 

The private-sector exercise modes share several fundamental similarities. In all four modes, a 
private-sector participant's emergency response team, director, or subject matter expert (SME) 
monitored real-world and simulated channels for information on the unfolding WMD scenario. 
In all modes, private-sector participants were authorized to disseminate exercise-related 
information to tho.se personnel at their same location who had relevant responsibilities for 
responding to the events. All private-sector participants were expected to respond to information 
about unfolding events according to their pre-established policies, plans, and procedures. For 
most private-sector participants, this included well-defined emergency response and business 
continuity plans. Finally, all private-sector participants were free to activate their organizational 
command posts or EOCs, even though the play mode selected had an effect on the extent of 
communications these command posts and EOCs could initiate. 

Of the four private-sector play modes, FSE mode afforded participants the most robust play. 
During the exercise, four private-sector organizations playing in FSE mode actually carried out 
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emergency response operations, including tactical field operations at one or more of the physical 
locations of the simulated attacks and responses in Connecticut and New Jersey.^ These 
FSE-mode players were permitted to coordinate response activities and to initiate 
communications with any other registered, relevant T3 participant. FSE-mode players were 
expected to conform their play as closely as possible to the response activities they would 
actually conduct had the events been real. FSE-mode play was more appropriately suited to non- 
profit organizations. Few for-profit organizations elected to play full-scale by actually shutting 
down their operations or deploying participants for tactical field operations.’ 

Approximately 100 private-sector organizations played in private-sector TTX mode. In general, 
the only external communications TTX-mode players were permitted to initiate were with the 
Nice Watch or, for those playing in the Connecticut and New Jersey venues, with the 
Private-Sector Liaison in their respective state’s EOC. But TTX-mode players had the option of 
physically co-locating with a CPX-mode player. In this arrangement, the CPX's T3-trained 
controller served as the controller for the TTX-mode player as well. Any TTX-mode player that 
chose this option was permitted an expanded range of communications, including with any other 
registered and relevant T3 player. 

Approximately 36 private-sector organizations played in the private-sector CPX mode. In this 
mode, the response activities by private-sector organizations extended beyond the internal use of 
exercise-specific information to (primarily notional) coordination of response activities and 
communication with other registered T3 participants. Private-sector CPX-mode players that 
activated an organizational command post or EOC could use it to handle two-way 
communications with relevant T3 participants from both the private and public sectors. A few 
TTX-mode and CPX-mode players actually mustered and exercised first responder units, but not 
at any of the physical locations of the simulated attacks and responses. 

Three separate sets of private-sector organizations and associations played in the closed-loop 
exercise (CLX) mode. Each CLX required a CPX with its T3-trained controller. CLX-mode 
players were permitted to initiate communications only with their CPX. Members of a CLX 
could communicate with the other members of their own CLX but only if their CPX controller 
joined in on the teleconference. 

CLX mode was devised during the latter stages of the exercise planning phase, when it was 
determined that a fourth, new mode of play was needed to accommodate three private-sector 
organizations and associations. Each of the three represented a large group of players (50-I-) 
within a highly specific critical infrastructure or unique sector. The individuals within these 
organizations and associations needed to share exercise-related information with one another in 


^ As one example, the Salvation Army deployed and operated its canteen operations to feed and care for 
emergency response workers at the site of the simulated attacks at the City Pier in New London. 
Connecticut. Such tactical field operations required a Memorandum of Agreement with DHS ODP and the 
applicable authorities as well as with the venue support team and exercise planning team. 

’ Nevertheless, for-protlt private-sector T.^ participants from several critical infrastructure/key resources 
sectors - including transportation, commercial facilities, and telecommunications - have reported that they 
woul^)refeM^h^xercis^lesigi^erTniOi^(^ia^i^S^iiod^lunn^TOPOF^^^^^^^^^^^^^^ 
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order to test their respective emergency response and business continuity plans. But a concern 
arose that the exercise-related information and inquiries any one of these three groups could 
generate would potentially be too voluminous and multifaceted to be handled efficiently by the 
rest of the exercise. 

Almost all private-sector players participated in T3 in the TTX, CPX, or CLX mode and 
executed the great majority of their response activities notionally. Few played in FSE mode and 
carried out their activities “on the ground.” The additional artificialities of not playing in FSE 
mode are likely to have had the most significant effect on private-sector players in critical 
infrastructure sectors .such as the electricity .sector and the telecommunications .sector. In a real 
event, they would have had to provide services, maintain equipment, and make critical 
employees available in the affected areas despite major obstacles such as travel restrictions and 
limited prophylaxis distribution. Playing in a private-sector mode other than FSE would have had 
far less effect on the ability of participating private-sector organizations to conduct internal tests 
of their own emergency response and business continuity plans. 

Table I shows the number of private-sector organizations that played in each of the four private- 
sector exercise modes. 


Table C-1. Number of Organizations Playing in Each Private Sector Exercise Mode 



TTX 

CPX 

CLX 

FSE 

National 

59 

14 

3 

0 

Connecticut 

11 

13 

0 

2 

New Jersey 

30 

9 

0 

2 

Total 

100 

36 

3 

4 


B. Information Exchange in CPX and FSE Modes 


Importantly, private-sector organizations playing at the CPX or FSE level were responsible for 
ensuring that all private-sector organizations with which they exchanged T3 information were 
authorized to play in T3. A private-sector organization was authorized to play in T3 when the T3 
Exercise Director approved the organization's Player Fact Sheet. The exchange of exercise- 
related materials and information with any individual or organization that was not approved for 
T3 play was prohibited. 

Organizations playing at the CPX or FSE level were required to designate an organizational 
point of contact to interface with the T3 exercise team. Tfiis individual functioned before the 
exercise as an exercise planner and attended the one-day field controller and data collector 
training program. During play, this individual functioned as a field controller/data collector and 
ensured that the organization followed the rules for infonnation exchange and .stayed within the 
prescribed boundaries of the exercise. Rather than identifying an individual to serve as a pre- 
exercise planner and field controller/data collector, an private-sector participant playing at the 
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CPX or FSE level could rely on an overarching organization^ and physically co-locate at the 
overarching organization’s command post or EOC during the exercise. The overarching 
organization was responsible to ensure that all co-located private-sector participants followed the 
information exchange rules and did not violate the exercise’s boundaries. 

C. Flexible Hours of Private Sector Play 

In addition to multiple modes of play, T3 private-sector integration offered participants flexible 
hours of play to accommodate the amount of time and number of personnel each organization 
could make available for the exercise. The PSWG scheduled official hours for private-sector 
play, but private-sector planners and players determined the best hours of play for themselves 
and their organizations. 

The official hours of play for private-sector players in the FSE were chosen to permit the players 
to allocate their time efficiently to correspond with the major private-sector-related events in the 
exercise scenario. These hours were: 

April 4 (Monday) 12:00-20:00 STARTEX (NICC Alert Sent via ENS at 15:08) 

April 5 (Tuesday) 08:00-16:00 

April 6 (Wednesday) 07:30-16:00 

April 7 (Thursday) 08:00-14:00 ENDEX for NICC Private Sector Cell, 

Nice Hotwash 14:.30-16:00 

April 7 (Thursday) 08:00-11:30 ENDEX for Other Private Sector Participants 

All private-sector participants were informed of the official hours of private-sector play. But 
because most private-sector participants did not play during this entire range of hours, all 
private-sector controllers in the T3 Master Control Cell and the Connecticut and New Jersey 
Venue Control Cells were provided a play schedule for all private-sector participants. 

Knowing in advance the approximate timing of the initial disclosures of the simulated terrorist 
attacks, the Exercise Planning Team informed private-sector participants to be ready to play 
sometime between 12:00 and 15:00 on the first day of the FSE.^ Pre-exercise documentation and 
other communications emphasized that, if private-sector participants failed to receive 
notification, those who wanted to play from the beginning of the private-sector-related events 
should arrive at their play locations by no later than 15:00.' 


Examples of overarching organizations that acted in this role in the State venues during T3 include ASIS 
International and the Fairfield County Business Council in Connecticut and the New Jersey Business Force 
in New Jersey. The DHS/ICD National Infrastructure Coordinating Center and the FEMA NRCC acted in 
this role in the National venue. 

On the first day of the exercise. April 4. 2005, VNN made its first report of plague (type unspecified) at 
1 1 :50- VNN made its first report of the explosion at the New London City pier in Connecticut about an 
hour and a half later at 1 3:30. 

The actual alert to the private sector of the simulated events was sent by the NICC via the Emergency 
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Play ended for all private-sector participants other than those playing at or through (i.e., 
virtually) the NICC Private Sector Cell at approximately 1 1:30 on Thursday, April 7. End of play 
for the Nice Private Sector Cell was the same day at 14:30. An NICC Private Sector Cell 
Hotwash followed immediately afterwards. Private-sector T3 players attended the Hotwash 
physically and via teleconference. 

D. Prototype Positions for Private Sector Coordination 

During the exercise, three new positions were created and played to facilitate private-sector 
coordination with FSL incident management. A Private Sector Liaison position was created and 
played in the Connecticut EOC and a Private Sector Liaison Cell in the New Jersey EOC. A 
Private Sector Cell was established in the NICC. 

These positions do not actually exist yet. They were prototyped in part to facilitate the T3 
private-sector integration objective of improving public-private information sharing processes 
and capabilities and with the intention of institutionalizing them after the exercise. 

As artificialities, these mechanisms provided private-sector players the opportunity for increased 
intra-sector coordination, particularly at the national level. As a result of being physically or 
virtually located at the NICC, private-sector representatives were able to gain a better 
understanding of the actual operations of the national mechanisms and procedures for 
coordinating and communicating with the private sector. 

Without these prototypes, there would have been less understanding and greater confusion 
among the private sector about overall situational awareness, including each agency’s incident 
management and emergency response responsibilities. In addition, much of the cross-sectoral 
coordination and communication during T3 occurred at or through the NICC Private Sector Cell. 
Without this cross-sectoral coordination and communication, there would have been far less 
interaction between critical infrastructure repre.sentatives and FSL government representatives. 

E. Minimal Testing of Unsolicited, Unmanaged Volunteers and Donations 

In response to real events of the magnitude of T3, the public has a history of providing large 
numbers of volunteers and quantities of donations that incident management officials have not 
solicited, do not have the resources or authority to manage, and often find do not meet the real 
needs in the field. The 9/1 1 terrorist attacks are just one real-world example in which the number 
and magnitude of unsolicited, unmanaged volunteers and donations substantially interfered with 
critical response and recovery activities. 

In T3. such unsolicited and unmanaged volunteers and donations did not appear even notionally, 
much less actually. The exercise was designed to have private-sector players from faith-based 
organizations act as role players and place dozens of telephone calls to FEM A/Volunteer 
Organizations Active in Disasters (VOAD) to offer substantial numbers of unsolicited volunteers 
and donations. But, in order to avoid overwhelming the resources of FEMA/VOAD that were 
available for the exercise, the play of these faith-based organizations was terminated on the 
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exercise’s second day. Thus, the FSL incident management teams did not have to face the 
volunteer and donations management problems that a real-world event would have produced. 

F. Multi-State Effects on Private Sector 

Multi-state effects on the private sector were largely absent in T3. As a result of real incidents of 
this magnitude, the effects propagating to states other than Connecticut and New Jersey would 
have had a profound impact on the private sector. 

For example, it is unrealistic to assume that other states or the Federal government would have 
allowed unrestricted travel by members of the trucking industry and the public who had recently 
been present in New Jersey. Distribution centers and warehouses would have been likely to 
refuse shipments that originated in New Jersey. Those that had accepted such shipments before 
the plague attack was discovered would be in crisis mode attempting to determine whether they 
were infected or clean, as well as whether they could continue to ship and receive goods. The 
results would have included cascading delays in supply chains and possibly severe shortages of 
key resources. 

Airline passengers who had recently been in New Jersey also would have been subjected to some 
type of official procedures to determine whether they posed a threat to the health of others. It is 
probable that this would have had a significant effect on the operations of the airline industry, 
and possibly a negative economic effect as well. 

Similarly, the arrangements private-sector representatives in the transportation sector made with 
New Jersey officials to transport key resources and other goods into New Jersey after the travel 
restrictions were imposed relied on neighboring states, including Pennsylvania and Delaware, for 
staging. But those states were not playing in T3. All decisions and cooperation by these 
neighboring states’ officials had to be assumed or simulated. Thus, it cannot be concluded that 
these public-private arrangements forged to adapt to the travel restrictions would have been 
possible in a real incident. 

G. Lack of Real-World Demand for Key Resources 

During the exercise, the public did not demand food and other basic necessities when shortages 
of these key resources occurred or were threatened. The exercise’s lack of real-world demand 
pressure for these key resources is a significant artificiality. 

The transportation sector and food sector players in the NICC Private Sector Cell reported that 
they had a difficult, but manageable, arrangement for transporting food and other key resources 
into the affected areas in New Jersey before the travel restrictions. After the restrictions were 
imposed, this arrangement was no longer workable and private-sector players scrambled to 
fashion an alternative. But the food warehousing, distribution, and retailing systems in a state 
typically contain Just a few days’ worth of food under normal demand conditions. Private-sector 
members of the food sector in New Jersey estimated during T3 that - when purchasing patterns 
are normal - approximately 1-2 day’s of perishable food inventory and 6-8 days’ of non- 
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perishable food inventory is present within the overall system at any given time. Although the 
“just-in-time” supply system is flexible and responsive to market forces under normal conditions, 
it is fragile and difficult to restore when shut off or severely disrupted, even for short periods. 
And public confidence in the ability of the supply chain to deliver key resources may be one of 
its most vulnerable links. 

It was not possible to simulate the real-world demand for food and other key resources, and the 
cascading effects of potential shortages could not be fully calculated. However, private-sector 
representatives of the food sector in New Jersey played the supply chain disruptions and 
consequences out notionally and concluded that the food shortages would be significant enough 
to engender civil unrest. The extent of damage from this civil unrest would cause the food 
industry in New Jersey to still be in the recovery mode at least 30 days after the end of the 
exercise. 

H. Lack of Real-World Stresses on Specific Critical Infrastructure Sectors 

Some critical infrastructure sectors were not stressed to the extent and degree they would have 
been had the T3 attacks been real events. As one example, a private-sector participant 
representing the electricity sector noted that the sector was tested only lightly and would have 
undergone far greater stresses had the scenario played out beyond the scheduled four days. 

The telecommunications sector in particular was subjected to a noteworthy lack of significant 
stresses during T3. As one participant at the NICC Private Sector Cell noted, 
telecommunications facilities across the board were expected to and (notionally) remained fully 
operational and underutilized for the entire exercise. But even real-world events that are far more 
localized and result in far fewer casualties than the simulated T3 events cause significant stress 
and over-utilization of telecommunications facilities.*' Thus, any overall assessment of the 
ability of the nation's critical infrastructure to weather a real-world attack similar to the 
simulated T3 attack must take into account the exercise’s designed-in lack of stress on 
telecommunications systems and facilities. 

Similarly, the play of the financial sector was, by design, confined within a CLX. This CLX 
reported that it successfully tested its critical ringdown system, which ensures that key 
representatives of the financial sector can contact and share information with each other during 
an emergency. But little financial information from that closed loop was communicated to or 
played within the rest of the T3 exercise. Therefore, there is little to be gleaned from T3 
regarding the effects of events of this nature on the strength of the financial sector and the 
national economy. 


' ' (See London rocked by explosions. CNN.com, July 7, 2(X)5 (available at 
htt£j£wwwxnn^com/2005/WORLD/etm)£e/07/07/tondoirtube^nde)yMml)^ 
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V. Exercise Observations 


This section describes observations of issues that arose that involved the private sector and were 
not expected before the exercise. The observations were derived from the private-sector secure 
messages, the venue chat logs, and NICC data collector logs. The three main observations were: 

• FEMA/VOAD chose not to exercise the NRP Volunteer and Donations Management 
Annex; 

• surprisingly little official information flowed from FSL government to the private sector; 
and 

• only a few days’ worth of reserves exist in the supply chain for key resources such as 
food and hospital supplies. 

On the second day of the FSE, a conference call took place between four faith-based 
organizations and the American Red Cross (ARC), VOAD, and FEMA. At that time, the faith- 
based organizations offered both volunteers and donations. The support was turned down. 
Volunteers and/or donations would be solicited through the partner organizations already in 
place on the local or statewide level. The faith-based organizations were told to contact their 
local chapter of the ARC which would draw on its constituency if needed. Due to the refusal of 
unsolicited volunteers and donations, the coordination mechanisms defined in the Volunteer and 
Donations Management Annex of the NRP were not able to be exercised. 

Throughout the FSE, FSL governments made decisions that affected the private sector, but were 
not communicated to the private sector. The decision to raise the threat condition to Red in New 
Jersey and the protective measures to be taken under that condition were areas in which the 
private sector did not receive official information from the public sector, During the New Jersey 
government discussions on the lifting of travel restrictions, a decision was made to open one lane 
on the highway to allow for the movement of supplies. At least one large shipping firm was not 
told of the access lane until well after the government had op>ened it. If it had been involved in 
the decision-making process, the firm could have scheduled and positioned its assets to make 
efficient use of the limited travel access. Also, the private sector was never informed of 
recommended protective measures that were developed by DHS. 

The scenario in New Jersey and Connecticut demonstrated the scarcity of reserves of food and 
medical supplies that would be essential in a real-world incident. Not long after the plague began 
to spread in New Jersey, hospitals experienced critical shortages of supplies such as masks, 
gloves, and IV fluids. As New Jersey was put under threat condition Red and travel restrictions 
were pul in place, the food sector was severely hampered. Most retail food stores and distribution 
centers only have a few days worth of supplies on hand and food shipments were stopped at the 
border. In Connecticut, a shelter-in-place order was given by the Governor for an area 
surrounding New London. If the shelter-in-place order had lasted for just two or three days, 
companies subject to the order who were sheltering their employees would have run out of food. 
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VI. Key Issues 

This section addresses significant issues identified during the planning and execution of T3 
private-sector integration. These issues are derived from private-sector participants' observations 
and feedback contained in comments and documents from Hotwashes and After Action 
Conferences and in numerous other feedback sources. The issues grouped into six broad 
categories: 

• Prototype Private Sector Coordination Mechanisms 

• Public-Private Coordination and Communication 

• Testing Internal Emergency Response and Business Continuity Plans 

• Cross-Sector Coordination and Communication 

• Private Sector Planning 

• NRP Volunteer and Donations Management Support Annex 
A. Prototype Private Sector Coordinating Mechanisms 

The effectiveness of three private-.sector coordinating mechanisms prototyped during the 
exercise — the Connecticut Wvate Sector Liaison position, the New Jersey Private Sector 
Liaison Cell, and the NICC Private Sector Cell — led private-sector players to request that they be 
institutionalized for real-world incidents. The Private Sector Liaison in the Connecticut EOC 
provided briefings and updates three times a day during the FSE. Electronic bulletins were 
broadcast to every registered e-mail address, pager, and cellular telephone notifying private- 
sector participants of an upcoming situational awareness briefing, which was then broadcast to 
all registered cellular telephones. After the situational awareness briefing, registered private- 
.sector players had the opportunity to engage in a question-and-answer session with 
representatives of the Connecticut EOC. On average, approximately 20 of the 26 private-sector 
organizations playing in the Connecticut venue participated in each of these question-and-answer 
sessions during the exercise. 

The Private Sector Liaison Desk at the New Jersey Office of Emergency Management (OEM) 
handled “hot issues” from companies in New Jersey and passed along questions to the 
appropriate Infrastructure Advisory Committee chair. The Private Sector Liaison served as a 
single, centralized point of contact in the State government for representatives of critical 
infrastructure sectors and industry, making it easier for the private sector to determine who they 
needed to contact with their problems, requests, and offers of assistance. 

The Private Sector Cell at the NICC integrated the DHS specialists with their counterparts 
representing each critical infrastructure sector. Participants also included private sector players 
representing other industries and sectors who were playing at the National (as opposed to the 
State) level. Other than NICC staff. Table 2 lists the number of participants in the NICC Private 
Sector Cell. 
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Table C-2. Participants in NICC Private Sector Cell 


Personnel Category 

Number of 
Participants 

Critical Infrastructure/Kev Resource Group 

141 

DHS Private Sector Office (PSO) Group 

47 

PCII Group 

6 

Observers 

12 

T3 Controllers and Data Collectors 

12 

T3 Exercise Support Team 

6 


The Critical Infrastructure/Key Resource Group in the Private-Sector Cell was composed of 
private-sector representatives of the nation’s CI/KR sectors, representatives of the Information 
Sharing and Analysis Centers (ISACs), and sector specialists from the DHS Infrastructure 
Coordination and Analysis Office (ICAO). The DHS Private Sector Office (PSO) Group 
included private-sector participants not directly representing a CI/KR sector as well as members 
of the DHS PSO. 

The NICC provided two briefings each day, including via secure teleconferencing and 
presentation facilities to those participating in the Private Sector Cell virtually. Private-sector 
players reported that physical or virtual participation in the Private Sector Cell facilitated 
effective coordination within and, with some exceptions, between sectors. Participants also 
reported that they gained a better understanding of the Federal government’s actual operations 
during an INS. 

B. Public-Private Coordination and Communication 

Issues surrounding coordination and communication between the government and the private 
sector dominated the comments and feedback from the private-sector players. The issues fall into 
three categories: 

• Lines of Communication 

• Method of Communication 

• Coordination 

C. Lines of Communication 

For many private-sector participants, T3 illuminated the official links for coordinating and 
communicating with FSL government, and highlighted some the weaknesses in those links. 
Private-sector participants frequently mentioned in their feedback that the exercise enabled them 
to gain a better, more realistic picture of what information and resources would be available from 
FSL government during a real-world response to a WMD terrorist attack. They learned what 
steps the private sector would have to take to coordinate effectively with the government to 
obtain this information and these resources. 
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Private-sector participants were surprised by the lack of information coming to them during the 
execution of the exercise from official channels in FSL government. For the private-sector 
players in the National venue, this surprise centered on communications from the top down, 
starting from the White House to the DHS Secretary, the IlMG, and ultimately to the DHS sector 
specialists and their private-sector counterparts. Notwithstanding the benefits provided by co- 
locating the Private Sector Cell prototype at the NICC, participants concluded that the 
information they received back from the IIMG, the NICC, and other Federal organizations was 
slow and of insufficient quality. For example, at the end of the first day of the FSE, private- 
sector players were concerned by and had received little information explaining why 
transportation was not “locked down tight” to contain the plague. Furthermore, the lines of 
communication and authority between the NICC, the IIMG, and other organizations were unclear 
to the private sector. 

]. Methods of Communication 

One of the primary methods by which the private sector and the Federal government 
communicated during the exercise was through the request for information (RFI) process, But 
private-sector participants found the process confusing and inefficient. The process for 
responding to RFIs received by private-sector players via the NICC was not well-defined or 
well-communicated. Private-sector players in the NICC Private Sector Cell reported that they 
spent too much time on RFIs as a whole and that the time they spent on each one was not used 
efficiently because the RFIs they received were not prioritized. They further commented that 
they should have received feedback to the responses; this would have enabled them to assess the 
appropriateness of and priority given to the information they provided. 

Private-sector participants repeatedly asked that when they send out an RFI, they receive a 
timely response, even if the response is nothing more than the status of their request. For 
example, the Real Estate ISAC had to request information on the cancellation of sporting and 
convention events multiple times on multiple days before the commercial facilities sector 
received relevant information from the NICC. To permit timely responses, the RFI process 
needed to be clarified so that the information necessary to the private .sector is managed by 
appropriate Federal personnel who can distribute it to Federal coordination mechanisms to be 
acted upon and shared with the private sector 

A second method through which the public and private sectors communicated was through 
e-mails. However, many private-sector participants had problems with the e-mail system 
provided- Many players were not able to keep up with incoming e-mail pertaining to the 
exercise. Also, most e-mails were not clear as to who the message was supposed to go to, who 
was supposed to respond to the e-mail, and whether or not it was a question or a statement. In 
order to remedy that situation, the private-sector participants requested more dedicated phone 
lines, cell phones, and modes, other than e-mail, for private sector office officials to be reached 
in emergency situations. 

Participating private sector organizations emphasized that they have the ability, capacity, and 
redundant systems necessary to pass information quickly and efficiently to their sectors, 
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industries, nationwide locations, and workforces. In the absence of timely information from 
public officials, the private sector turns to other sources, sometimes resulting in decisions that do 
not match the actual situation. For example, at the time when representatives of the 
transportation/raii sector responded to an RFl, they had not received the information that New 
Jersey was raising its threat advisory level to Red. If the railroad sector had known about the 
raise in threat level, their response to the RFI may have been different. If the private sector does 
not receive credible and reliable information from official sources, businesses and industries go 
ahead and adjust the supply chain according to their own continuity plans or in response to 
perceived threats based upon unofficial, back-door communication links. 

2. Public-Private Coordination 

Critical decision making by the government in the midst of a crisis can have significant 
unintended consequences if not fully coordinated with the private sector in advance. Throughout 
the exercise, there was a widespread lack of knowledge of the protocols involved and the 
appropriate private-sector responses to a decision by a State government or by DHS to raise the 
threat advisory to the Red level. For many private-sector participants, the greatest challenges 
faced during the exercise were a result of the State of New Jersey declaring Red and imposing 
travel restrictions, both with little or no advance coordination with the private sector. Emergency 
travel restrictions seriously limited the movement of critical employees and supplies within the 
private-sector workforce. When the discussions regarding the lifting of such restrictions take 
place, the private sector should be involved. The private sector requested clarification of and 
involvement in the decision-making process for raising and lowering threat advisory levels. 

The private sector would also like to improve the coordination during response and recovery 
efforts of private-sector assets. The private sector has an array of assets at its disposal: facilities, 
materials, supplies, vehicles, and even aircraft. When governmental response resources are 
stretched or stressed, the private sector could provide assistance. DHS, as well as State OEMs, 
must know in advance who within the private sector owns or controls which assets. Pre- 
coordinating these assets would enhance preparedness and facilitate a more effective response 
within each state. 

The DHS PCII Program was developed to enhance public-private coordination and information 
sharing. This program enables members of the private sector to voluntarily submit to the Federal 
government sensitive information regarding the nation’s critical infrastructure with assurances 
and safeguards protecting the information from public disclosure. Testing the PCII Program was 
one of DHS's express objectives for T3 private-sector integration. The NICC established a PCII 
Coordination Cell for the exercise to handle and expedite PCII protections for critical 
infrastructure information submitted by the private-sector participants. 

The data show that some testing of the PCII Program took place during the exercise, including 
PCII approval of information submitted by the chemical sector and subsequent use of that 
information by the Transportation Security Administration (TSA). It was also noted that the TSA 
sought to share this information with a State EOC until a PCII representative explained that the 
PCII Program has not yet approved states to receive such information. But the data on the whole 
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suggest that the PCII Program was tested only lightly and are insufficient to support any 
conclusions about the program’s effectiveness or efficiency during disaster response operations. 

D. Te.sting Internal Emergency Response and Business Continuity Plans 

T3 raised the level of awareness of many private-sector organizations' employees regarding the 
critical roles that their business functions and emergency response plans play during an event. 
The exercise illustrated to private and public sector players that cascading effects of absenteeism, 
especially of critical employees, can shut down organizations and sub-sectors. Private-sector 
organizations must be able to get critical employees to work to maintain continuity of operations. 
A large percentage of the huge (notional) financial losses in the New Jersey chemical sector 
(estimated at $557 million during the first week of the FSE alone) was caused by absentee- 
related plant closures or slowdowns. Even an automated operation requires critical employees to 
enter areas affected by events when vital systems go down. But during the FSE, a lurking, 
unresolved question arose about the definition of a critical employee and whether the criteria 
applied by law enforcement will match the private sector’s definition. It is unclear whether the 
necessary training and coordination has been undertaken to enable law enforcement personnel to 
recognize specially marked company vehicles. 

T3 also provided a useful, realistic opportunity for private-sector organizations to test their 
emergency response and business continuity plans. With some exceptions, a large majority of 
responding private-sector organizations reported that the realism and richness of the FSE 
scenario and events permitted them to gain a better understanding of the strengths and 
weaknesses of their plans. The commercial facilities sector reported that large disparities 
continue to exist in the sector’s response capabilities and emergency plans, which range from 
excellent to non-existent. Some facilities’ management plans to automatically self-evacuate 
during an event, and there is no industry standard response to a shelter-in-place instruction by a 
State. For this purpose, the private-sector participants sought improved information and 
coordination on appropriate private-sector protocols and responses to heightened Federal and 
State threat alert levels. 

Several companies said that they would consider volunteering their facilities to be Points of 
Dispensing (PODs) under the Strategic National Stockpile program. Many private-sector 
participants felt that hosting a IK)D would be part of their business continuity planning. 
Community Emergency Response Team training for company volunteers would be necessary to 
enable private-sector organizations to fulfill this commitment. 

E. Cross-Sectoral Coordination and Communication 

T3 provided many examples demonstrating that coordination and communication between 
various sub-sectors of the private sector are both indispensable and often insufficient to respond 
effectively and efficiently to an event of this magnitude. Private-sector organizations themselves 
gained a greater awareness of the extent of critical infrastmcture interdependencies, and the 
Nice Private Sector Cell provided many opportunities for and examples of positive, effective 
cross-sector communication and coordination. The food and agriculture sectors and the 
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transportation sectors engaged each other and many other sectors in decision making and 
information gathering, which had important effects on the movements of key resources during 
the FSE. Representatives of the private-sector players in the NICC Private Sector Cell repeatedly 
organized and coordinated cross-sectoral lines of communication. 

In many cases, participating private-sector groups did not know what decisions were being made 
in other sectors and by whom they were being made. They reported that their knowledge, or their 
lack of knowledge, of those decisions would have significant impacts across sectors in a real- 
world event. It was noted that in real lime, a useful display of critical information could be 
presented at the NICC Coordination Center Cell, which would include a summary of the current 
situation, a timeline of events, and the time and substance of major governmental decisions that 
have been made. Several private-sector participants expressed support for the creation of a 
private sector analog to the IIMG, which would, in their view, improve cross-sector integration 
for planning and evaluation. 

F. Private Sector Integration Planning and Training 

A large majority of the private-sector organizations that provided feedback stated that the 
exercise was thoroughly and professionally planned in a manner that allowed them to participate 
effectively and realistically in the event scenario and response and recovery efforts. A few 
commented that the involvement of private-sector participants in the planning process was 
insufficient and did not enable them to exert sufficient influence on the design of the exercise to 
ensure meaningful, realistic play for their organizations. Some private-sector participants also 
felt that they would have benefited from additional or more in-depth training. A key observation 
was that those who represent the private sector in exercises must be SMEs who are well-versed 
in each subject matter and sector for which they are responsible. In addition, those representing 
the private sector during actual events must have substantial exercise and/or real-world disaster 
response and recovery experience. 

Private-sector participants commented on the need for greater private-sector input into the 
National Infrastructure FVotection Plan and the NRP. The private-sector integration in these plans 
needs to be more robust, and this requires substantial private-sector assistance. 

G. Volunteer and Donation Management Support Annex 

Little actual testing of the NRP Volunteer and Donations Management Support Annex was 
conducted during T3. Faith-based organizations who had been trained to execute injects by 
simulating members of the public telephoning VOAD to offer unsolicited volunteers and 
donations were requested by agency-affiliated players to stop participating on Day 2 of the FSE. 
Protocols were apparently not in place for handling VOAD-type donations and volunteers. The 
decision was made to suspend this play because the telephone call injects would have flooded the 
local VOAD centers. It was stressed that the volunteer and donations management function was 
unprepared to handle the influx of calls and donations that could potentially come in during a 
real-world crisis. The lesson learned was that VOAD is not yet prepared for massive offers of 
voluntary assistance and donations at the local or national levels. Additional testing and 
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emergency response operations development is necessary for the volunteer and donations 
management system to be prepared to handle a 9/1 1-style outpouring of volunteers and donations 
in a future exercise or real-world event. 

Faith-based organizations’ participation in T3, particularly in the planning stages, did provide 
them experience in coordinating with the Federal government for disaster response efforts. A 
leader of one of the faith-based emergency management organizations stated immediately after 
faith-based play was shut down that their involvement in T3 led his local VOAD director to offer 
to meet with him after the exercise to share lessons learned, as well as how faith-based 
organizations can be a part of that VOAD district’s working emergency response plan. 

VII. Conclusions 

Exercise play in T3 provided an unprecedented range and number of private-sector organizations 
an opportunity to exercise their coordination and communication with FSL government in 
response to a domestic WMD terrorism attack. The scope and magnitude of private-sector 
participation in T3 were far greater than in T2. A significant majority of the private-sector 
participants who provided feedback agreed that the planning and execution of T3 private-sector 
integration was effective and facilitated robust play by their organizations. They further reported 
that T3 enabled them to test their emergency response and business continuity plans in an 
effective, realistic manner. Numerous organizations are improving the.se internal plans as a 
result of the exercise. 

Private-sector participants also reported good coordination and communication within their own 
sectors and with their sector’s DHS sector specialists. Much of this was facilitated by the 
prototype Private Sector Liaison mechanisms in Connecticut and New Jersey and the prototype 
Private Sector Cell in the NlCC. There is a broad consensus among private-sector participants 
that these mechanisms should be institutionalized for operation during real-world events. 

But T3 also demonstrated that real-world integration of the private sector into FSL government 
disaster respon.se and recovery efforts is still in or near its infancy. Official government sources 
provided private-sector participants little of the information they needed to make sound, 
informed decisions. Private-sector participants perceived themselves to have been omitted from 
the decision-making processes on critical issues affecting their interests, as well as their ability to 
respond to the attacks. Private-sector participants deemed the lack of communication and 
coordination with official government sources to be particularly inadequate regarding travel 
restrictions, threat advisory level changes, and the availability and priority of necessary 
prophylaxis measures. Little or no advance private-sector coordination was provided before these 
decisions were announced. Once made, these decisions’ specific objectives and recommended 
responses were not effectively communicated to the private sector. As a result, private-sector 
participants were left to rely on their own sources of information'^ and their own criteria for 


'■ Often that meant only Virtual News Network (VNN), a simulated cable news network that broadcasted 
information about exercise-related events to T3 players via secure satellite downlink, and VNN.com, a 
simulate^ntenie^>ase^iew!^ervic^vaild>i^(^^la^ert^i^njecur^Wel^ite^^^^^^^^^^^^ 
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deciding how to protect their employees, keep critical employees on the job, and continue to 
provide services and resources essential to effective public -private response operations. Also, 
despite private-sector representatives’ efforts to provide effective responses to governmental 
RFls, FSL government entities reported that the roles, responsibilities, and resources that private- 
sector organizations offer in a disaster response operation remain unclear. 

Some cross-sectoral coordination occurred during the exercise, particularly through the operation 
of the prototype private-sector coordination mechanisms in Connecticut and New Jersey and at 
the Nice, But, most private-sector participants reported that cross-sector coordination and 
communication was inadequate to mount an optimal response to attacks of the magnitude 
simulated in T3. 

Two key testing objectives for private-sector integration were not realized in T3: testing the 
NRP’s Volunteer and Donations Management Support Annex and testing the PClI Program. 
Little attempt was made to re.spond to the telephone calls that were planned as exercise injects 
from role players from faith-based organizations who offered unsolicited volunteers and 
donations, The only reported result is that the faith-based players have a greater understanding of 
how to interact with the Federal government for disaster response and recovery. Similarly, given 
the lack of exercise data involving the PCll Program, no conclusions regarding its efficacy can 
be drawn from T3. 
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Annex D: Cyber Exercise in Connecticut 


I. Summary 

While the principal focus of the Top Officals (TOPOFF) exercises continues to be incident 
management, there is another element of our country’s critical infrastructure that experts consider 
highly vulnerable to a terrorist-related attack: the national information infrastructure. TOPOFF 3 
(T3) is the second Top Officials exercise to include a limited cyber component. 

The Connecticut T3 Cyber Exercise was conducted on a not-to-interfere basis with the T3 Full- 
Scale Exercise. It took place March 22-23, 2005, at the Connecticut Department of Information 
Technology headquarters in East Hartford. Connecticut. There were approximately 80 
participants including top officials and network operation centers (NOCs) from the Connecticut 
State Department of Information Technology, the Connecticut Department of Transportation, the 
Connecticut State Police, the Connecticut Education Network, and the city of New Haven. 

The major objectives of the exercise were to: 

• develop state and organizational information technology (IT) cyber security policies and 
procedures; 

• determine policy effectiveness related to large-scale cyber attacks; 

• develop strategies and planning frameworks to coordinate inter-governmental response 
and consequence management to cyber attacks; 

• maintain continuity of operations during a cyber attack; 

• develop recommendations for senior decision makers responding to potential cyber 
crisis events; and 

• to explore the government and private sector role in maintaining public confidence 
during and after a large-scale cyber attack. 

The exercise encompassed three cyber attack scenarios, each associated with different aspects of 
the cyber security problem. The intensity of the cyber attacks increased with each scenario, 
culminating in a final attack targeting specific networked entities within crisis or consequence 
management roles. 

The NOCs used a simulated network developed by the Institute for Security Technology Studies 
(ISTS) as the primary source of exercise-related stimuli. The network replicated elements of 
regional, wide-area networks and an inter-governmental network. 

After the exercise, participants highlighted the following key issues for consideration: 

• a need for documentation of new technologies plans, policies, and procedures; 

• development of plans and procedures associated with Homeland Security Advisory 
System (HSAS) levels; 

• a need to identify network organizations and their functions; 

• the importance of radio communications and non-voice over Internet protocol (VoIP); 
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• uniform government wide-area networks (WANs) policies; and 

• remote access network control applications. 

Participating top officials and NOCs felt that the Connecticut T3 Cyber Exercise was an 
excellent training tool and guide for current and future development of various information 
systems. 

11. Introduction 

The media frequently reports government officials’ concerns over terrorist plans to conduct 
internet-based cyber attacks. These news stories often recycle theoretical scenarios attributed to 
foreign government information warfare capabilities. But, terrorist organizations, such as the 
TOPOFF 3 universal adversary, may also use cyber attacks to disrupt emergency services as a 
means to reinforce and multiply the effect of a physical attack. The Connecticut T3 Cyber 
Exercise examined the integration of inter- and intra-govemmental actions related to a large- 
scale cyber attack on a major urban area of the United States. The attack was synchronized with 
a terrorist weapons of mass destruction (WMD) attack. 

in. Background 

The impact of cyber terrorism, both as an attack medium and as a means to disrupt crisis or 
consequence management, was highlighted as a shortfall of TOPOFF 2000. Accordingly, in T2, 
a cyber excursion was conducted to introduce the synergies associated with a blended terrorist 
attack. In planning T3, it was understood that incident management exercise including WMD 
and cyber attack elements might be counterproductive to the T3 objectives. Thus, the New Jersey 
and Connecticut state venues each held an isolated cyber exercise preceding the full-scale 
exercise. 

IV. Exercise Design and Artificialities 

During the exercise, players were divided into five NOCs and one support group (see Figure I). 
Over a f>eriod of two days, players worked through three cyber attack scenarios. To support the 
development of these scenarios, the exercise design team used an outline of the attacker’s (a 
generic "Red”) aims, means, and methodologies. 
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Figure D-L Network Topology 


Network Topology 



A simulated network, developed by ISTS, was utilized during the exercise. It served as the 
primary source for stimulating events and actions in the exercise. Regional, wide-area networks 
(e.g., the public access to governmental organizations) and an inter-governmental network (i.e., a 
private intranet used within the state) were replicated for use in the simulated network. Network 
status display console operators were briefed on how to use the simulated network before 
interactive play began. 

During each scenario, the teams (groups) responded to the data provided on the exercise 
simulated network, or through other means. They addressed plans, policies, and procedures, as 
well as many management or technical issues. Although incident management and cyber security 
plans provided a foundation for the participants’ actions and decisions, they were not constrained 
by these plans or other current, real-world plans and management concepts. The exercise was 
self-assessed and evaluation criteria were determined by each of the participating organizations. 

Scenario 1 , Disjointed Attacks, featured an “above normal” level of network disruptions. Players 
were asked to revalidate assumptions, upon which their incident response plans were founded, 
and to identify other suppositions. They also reviewed both the internal and external 
communication flows of their NOCs and discussed relevant cyber security issues. Players then 
identified and prioritized the implications of prolonged periods of “above normal” network 
disruptions. Finally, they examined the impacts on planned processes, courses of action, and 
resource requirements detailed in their response or disaster recovery plans. 

Scenario 2, Coordinated Attack, was a low-level, coordinated cyber attack against stakeholder 
organizations. Players addressed response issues related to this particular attack. In addition. 
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players acknowledged the actions necessary to respond to these attacks in a combined manner 
and resume network operations. 

Scenario 3, WMD Force Multiplier, was an overwhelming, coordinated cyber attack acting as a 
“force multiplier” for a combined terrorist WMD attack. NOCs addressed the necessary actions 
to re-establish or maintain network operations to permit crisis and consequence management. 

V. Exercise Observations 

Using their incident response plans, policies, and/or procedures, players reacted to the stimuli 
generated during these scenarios. Players then analyzed their reactions and evaluated the stimuli 
that were used in the scenario. The Control Team observed a general lack of communication 
within and between organizations. There often was a lack of written policies and procedures that 
could be used as guidance to their re.sponses. A heavy focus on the reaction of the players was 
recorded. It was also noted that participants had limited communication with the Federal 
government. 

One of the many challenges facing mo,st IT security programs is the relative newness of their 
supporting technologies and programs. As a result, many existing plans, policies, and procedures 
have not been documented. This exercise revealed the need to examine and record “who does 
what when” during both normal operations and accidental or malicious disruptions. 

The exercise also highlighted a need for the exploration of appropriate plans and procedures to 
respond to changes in the HSAS threat conditions. The exercise begged the question: What 
proactive steps should be taken when the threat condition escalates from Yellow to Orange and 
then to Red? 

During the cyber exercise, players learned that critical public health and safety functions exist on 
a network that some senior officials consider of secondary importance and may have a low 
restoration priority if network resources become limited. An important question to relate is: 
What organizations reside on a network and what functions do these organizations perform? 

An over-reliance on digital information technologies may cause the loss of important 
functionalities should significant network disruptions occur. The exerci.se re-enforced the need to 
retain radio communications and VoIP telephone capabilities, particularly in organizations 
involved in public health and safety. 

In complex, government WANs, especially if sub-networks spur from the WAN, uniform, 
consistent, and enforced polices are neces.sary to ensure network security and reliability. This 
exercise demonstrated that, without these policies, there is a potential for ineffective 
communication and coordination of WAN-wide problem resolution. 

Nearly all governmental networked information systems require “on-location” personnel for their 
overall operation and upkeep. Should government workers or contractors not be able to access 
their systems for whatever reason (such as chemical or biological contamination), these networks 
may degrade gracefully or crash. The exercise confirmed that business continuity, continuity of 
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operations, and disaster recovery plans should include remote access to network control 
applications. 

VI. Conclusions 

The Connecticut T3 Cyber Exercise focused on the player’s ability to respond to a large-scale 
cyber attack within the framework of a WMD event. It was an opportunity for participants to 
validate plans, policies, and procedures and refine their organization’s roles and responsibilities. 
In addition, participating organizations uncovered potential weaknesses and areas for 
improvement. The players gained valuable experience working in a controlled environment with 
a diverse group of skill sets. Collectively, they recognized the need for improved external 
coordination and communication with other organizations in solving the key issues identified 
during this exercise. Players expressed the desire to formalize existing exercise and training 
outreach programs to build upon the lessons learned through this experience and share them with 
others in the cyber security field. 
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Annex E: Cyber Exercise in New Jersey 


I. Summary 

The New Jersey Top Officials (TOPOFF) 3 (T3) Cyber Exercise, a one-day interactive tabletop 
exercise was conducted on March 30, 2005, at the Office of the Attorney General complex in 
Trenton, New Jersey. This exercise examined, in an operational context, the integration of inter- 
and intra-govemmental actions related to a large-scale cyber attack, synchronized with a terrorist 
weapons of mass destruction (WMD) attack. The exercise was designed to examine disruptions 
to networks, responses, the consequences to those disruptions, and the implications for protective 
measures. 

II. Introduction 

State agencies and municipalities encounter increased challenges when trying to respond to a 
physical WMD event, while also responding to disruptions of government-related information 
networks. The cyber exercise was de.signed to address this mutifaceted challenge. Accordingly, 
within the context of a WMD event, consideration was given to the following: 

• the effectiveness of the various cyber security policies, procedures, and practices of 
various departments and levels of government; 

• the ability of participating network operations centers to integrate and effectively 
conduct or manage a sustained response to a cyber attack; 

• the planned flow of communications and information in an operational response 
context; and 

• the decision and coordination processes considering a range of potential 
consequences. 

III. Background 

The specific T3 New Jersey Cyber Exercise objectives are as follows; 

• Examine information technology (IT) practices — including incident prevention, 
reporting, response, communications, containment, investigation, etc. — to effectively 
respond to the effects of a cyber attack. 

• Gain an understanding of implications for policies, procedures, and practices resulting 
from a cyber attack, including issues related to: 

o internal coordination (State, local, and private sector); 
o Federal notification and response; and 
o other organizations. 

• Refine a planning framework to: 

o enhance processes, policies/procedures, and training sufficiency; 
o maintain continuity of operations within participating organizations; 


UNCLASSIFIED - FOUO 

This Document Contains Canadian and United Kingdom Information 

E-l 





AAR 


T0P0FF3 


FO R OFF I C I AL USE ONLY 


o develop alternatives and recommendations for senior decision makers 
responding to potential cyber crisis events; and 
o sustain confidence in government information networks during an attack. 

IV. Exercise Design and Artificialities 

A. Scenario 

The scenario included a simulated, coordinated Internet cyber attack from a terrorist cell or other 
associated groups. The T3 Cyber Exercise scenarios were considered in context of a range of 
threats from "script-kiddy" to state-sponsored, coordinated and uncoordinated attacks. At the 
beginning of the exercise, it was unclear to participants if the attacks were coordinated events or 
merely random intrusions. The purpose of the attack was not to take down the Internet, but to use 
the Internet to erode public confidence in the government, while, at the same time, disrupting the 
Federal, State, and local government's ability to provide for the health and safety of the public. 

The overall technique employed within each interactive session was based upon the following 
paradigm: input ^ action o output. Using information provided by a scenario or scripted 
injects, participants responded to issues related to the specific theme of an exercise session and 
developed the products/actions required at the end of the sessions. 

Figure 1 shows the general flow of this interactive technique. 

Figure 1. T3 Exercise Technique 


INPUTS 
« Scenario 
« Inlernal Reporta 
<■ Media Reports 
^ Scripted Injects 
* Plan 
« Others 


-T^T echnique 


PROCESS 
^ Assess Situation 
O Idenlify Implications 
^ Develop Courses of Action 
O Review Resources 
o Decision Recommendation 
O Immediate Actions 



OUTPUTS 
Recommendations 
4 Network Actions 
O Internal Reports 
❖ External Reports 
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V. Concept of Exercise Activity 

The exercise was an opportunity for participating organizations and individuals to: 

• examine policies, procedures, and practices; 

• improve coordination and confidence; 

• augment skills; 

• refine roles and responsibilities; 

• reveal weaknesses and resource gaps; and 

• build teamwork. 

As this exercise was self-assessed, evaluation criteria were determined by each of the 
participating organizations. 

Although the incident management and cyber security plans in use by participating organizations 
provided a foundation for participants’ actions, their decisions were not constrained by these 
plans and other current real-world plans and management concepts. 

Figure 2 shows the broad design concept. 

Figure 2. T3 Cyber Exercise Design 
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Multiple injects were used in three sessions of interactive play, each associated with different 
aspects of a cyber security problem (see Figure 3). These included: 

• Session One: This session exercised a variety of communications paths and explored 
some complex policy questions. New Jersey and Hudson County incident response 
capabilities and practices were examined. Law enforcement issues were included in 
the prepared scenarios. 
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• Session Two: This session exercised the players' ability to correlate information to 
determine complex attack vectors. Participants examined their capability to identify 
remediation actions and potential unauthorized information exposure. 
Communications, law enforcement, and policy issues were included. 

• Session Three: This session explored force multiplier effects and assessed their 
consequences. It included a major WMD event for .state agencies and a power failure 
to key county facilities and networks. 

Figure 3. Interactive Sessions 
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An executive-level seminar {see Figure 2) was conducted to examine policy issues and issues of 
common interest related to events that occurred during the three interactive sessions. Issues were 
framed and provided to an audience of “top officials.” 

VI. Participants 

T3 players were primarily those Federal, State, and county representatives who have active roles 
in the daily operations, management, and security of information networks, systems, or 
infrastructure within their organizations. These participants played key roles in responding to and 
managing the consequences of the significant cyber disruption events presented in the scenario. 
The primary players in the exercise were the IT organizations of: 

• New Jersey Department of Law and Public Safety, Office of the Attorney General 

• Office of Information Technology 

• New Jersey Department of Law and Public Safety, New Jersey State Police 

• New Jersey State Department of Health and Senior Services 

• New Jersey Department of Law and Public Safety, Office of Counterterrorism 

• Hudson County 
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Supporting these players were representatives knowledgeable in the following disciplines: 

• Commercial telecommunications providers, hardware and software vendors, and an 
Internet service provider (ISP) 

• Federal computer incident response agencies 

• Federal law enforcement agencies 

• Information sharing and analysis centers 

A. Top Officials 

A group of top officials from Federal, State, and county government organizations participated in 
the New Jersey T3 Cyber Exercise. The top officials were composed of executives at the 
commissioner level in positions to consider appropriate options for policy resolution. These 
individuals acted as an executive body to address and resolve cyber security issues challenging 
the State and county participants. 

VII. Exercise Organization/High-Level Network Topology 

Figure 4 depicts the overall organizational topology for the New Jersey T3 Cyber Exercise. 
During the interactive sessions, participants were divided into different teams and tasked to 
address cyber security policies, procedures, and practices, and other management or technical 
issues. Six organizations (five Stale and Hudson County) participated as principal players in 
these interactive sessions. 

Figure 4. Participating Agencies/Organizations 



Each exercise entity was composed of individuals familiar with their agency or department’s use 
of the cyber infrastructure. These entities responded to and managed the consequences embedded 
in each inject. Due to limited time, some elements were not addressed. Unresolved issues were 
brought forward in the final plenary session. The general respionsibilities of each group included: 
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• assessing the situation and defining the problems presented; 

• identifying the consequences of the problems and the impact of these consequences; 

• describing the actions necessary to respond/mitigate these challenges; and 

• determining the issues associated with these actions. 

A. Control Team 

A Control Team monitored all exercise activities and adjusted the process, as necessary, to 
support exercise objectives. The Control Team was respoiisibile for directing the exercise 
process, administration, and plenary sessions. Control Team members included co-facilitators, 
New Jersey exercise leads, recorders, and other selected individuals. 

B. White Cell 

A White Cell resided within the Control Team. White Cell members included Federal law 
enforcement, the Multislate-Informalion Sharing and Analysis Center. U.S. Computer 
Emergency Readiness Team, New Jersey State Prosecutors. New Jersey Slate Police (NJSP), 
NJSP Cyber Unit, NJSP Division of Criminal Justice, Regional Forensics Laboratory, and other 
entities that were integral to the conduct of exercise play. Participating organizations coordinated 
with other participating organizations or agencies as required by existing policies, procedures, 
and practices. 

Communication was accomplished through a closed network e-mail system or face-to-face 
meetings. Teams documented each communications exchange between teams. 

Figure 5 provides a notional layout of the exercise organization. 

Figure 5. Exercise Organization 
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VIIL Artiflcialities 

A. Network Operations 

The cyber security element of T3 was conducted on a not-to-interfere basis with the principal 
full-scale exercise; therefore, no real-life networks were employed. Each team worked from a 
representation of their own network approximating actual network functionality and 
connectivity. This graphic depiction was provided to each team at the beginning of interactive 
play. Injects presented to players were tailored to their organizational network. Players 
interpreted the situation in relation to their respective network and responded accordingly. 

B. White Cell 

Coordination among organizations or agencies not directly represented was accomplished 
through interaction with the ControlAVhite Cell. 

IX. Exercise Observations 

A. Key Issues 

Overarching issues fell principally into the categories of "Policies, Procedures, and Practices," 
communications, and risk management. 

The following issues were highlighted: 

• A leadership mechanism should be developed to provide oversight of New Jersey 
State cyber security and continuity of operations. 

• Policies and procedures should be distributed in writing to improve security and 
standardization of practices across the state (or country). 

• A service agreement should be in place to define obligations and expectations of both 
the provider and users, even though the ISP resides within the broader state 
organization. 

• A risk assessment should be conducted statewide on all IT-related capabilities. 

• Federal organizations must mature their capability offerings to better meet user needs, 

• ISPs, anti-virus vendors, and hardware manufacturers (servers and routers) offer 
potential to assist in developing responsive operational solutions to IT challenges. 

• Best practice documentation in areas such as configuration management, acceptable 
use, and incident response should be created and distributed. 

• A need exists for a recovery plan addressing the process, priorities, and any 
exceptions that may be required in the takedown of the entire state network. 

• Situation awareness requirements should be clearly established in policies and 
procedures, and the thresholds for reporting must be defined. 
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• A statewide list serve and non-Intemet-based notification system need to be 
established to inform state agencies and local government organizations of critical 
issues, incident response needs, critical alerts, etc. 

• A clearly defined threshold for reporting criminal intent or behavior to law 
enforcement should be established and documented. 

X. Conclusions 

The New Jersey T3 Cyber Exercise focused on the player’s ability to respond to a large-scale 
cyber attack within the framework of a WMD event. The players gained valuable experience by 
working in a controlled environment with a diverse group of skill sets. The players recognized 
the need for improved external coordination and communication and working with other 
organizations to solve the key issues identified during this exercise. Lessons learned emphasized 
a strong need for standardization, the lack of which allows weakness in areas that require 
strength and confindence in the event of a real-world incident. 
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Annex F: Acronym List 


A 

AAC 

AAR 

ACF 

ADLE 

AF 

AMEMB 

AMHS 

AMOC 

ARC 

ARF 

ASPHEP 

ATV 

AVOPS 

B 

BW 

c 

CBP 

CC 

CDC 

CDO 

CDRS 

CDS 

CERCLA 

CIA 

CIFA 

CIP 

CIS 

CLX 

CoC 


After-Action Conference 
After-Action Report 
Alternate Care Facility 
Advanced Distance Learning Exercise 
Air Force 

American Embassy 
Automatic Message Handling System 
Air and Marine Operations Center 
American Red Cross 
Action Request Form 

Assistant Secretary for F*ublic Health & Emergency Preparedness 
All-Terrain Vehicle 
Aviation Operations 


Biological Warfare 


Custom and Border Patrol 
Control Cell 

Centers for Disease Control and Prevention 
Command Duty Officer 
Communicable Disease Reporting System 
Communicable Disease Service 

Comprehensive Environmental Response. Compensation, and 
Liability Act 

Central Intelligence Agency 
Counterintelligence Field Activity 
Common Intelligence Picture 
Catastrophic Incident Supplement 
Closed Loop Exercise 
Chief of Control 
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COCOM 

Combatant Command 

COE 

Center of Excellence 

COLISEUM 

Community On-Line Intelligence System for End-Users and 
Managers 

COMDIR 

Communications Directory 

COMMPLAN 

Communications Plan 

CONORS 

Concept of Operations 

COO 

Chief Operating Officer 

COP 

Common Operating Picture 

COS 

Chief of Station 

COSIN 

Control Staff Instructions 

COTP 

Captain of the Port 

CPU 

Computer F*rocessing Unit 

CPX 

Command Post Exercise 

CRl 

City Readiness Initiative 

CSG 

Counter-Terrorism Security Group 

CST 

Civil Support Team 

CT 

Connecticut 

CT 

Counterterrorism 

CTC 

CIA Counterterrorism Center 

CTD 

FBI Counterterrorism Division 

CW 

Chemical Warfare 

CWA 

Chemical Warfare Agents 

D 

D/A 

Department/Agency 

DACC 

Department and Agency Control Center 

DAO 

Defense Attache Office 

DCID 

Director of Central Intelligence Directive 

DCO 

Defense Coordinating Officer 

DDNI 

Deputy Directors of National Intelligence 

DNI 

Director of National Intelligence 

DEA 

Drug Enforcement Agency 

DEP 

Department of Environmental Protection 

DEST 

Domestic Emergency Support Team 


UNCLASSIFIED 



This Document Contains Canadian and United Kingdom Information 

F-2 





AAR 


T0P0FF3 


DHS 

DHSS 

DIA 

DMAT 

DMORT 

DPH 

DPH ECC 

DOC 

DoD 

DOE 

DOJ 

DOS 

DOT 

DTRA 

E 

EAS 

ECC 

ECO 

EEl 

EMS 

EMSST 

ENDEX 

EOC 

EPA 

EPIC 

EPR 

ERT 

ERT-A 

ESF 

ESP 

EVALPLAN 

EXCON 

EXNMJIC 

EXPLAN 


Department of Homeland Security 
Department of Health and Senior Services 
Defense Intelligence Agency 
Disaster Medical Assistance Team 
Disaster Mortuary Operational Response Team 
Department of Public Health 

Department of Public Health Emergency Coordination Center 

Department of Corrections 

Department of Defense 

Department of Energy 

Department of Justice 

Department of State 

Department of Transportation 

Defense Threat Reduction Agency 


Emergency Alert System 

Emergency Control Cell 

Exercise Control Group 

Essential Elements of Information 

Emergency Medical Services 

Enhanced Maritime Safety and Security Team 

End of Exercise 

Emergency Operations Center 

Environmental Protection Agency 

El Paso Intelligence Center 

Emergency Preparedness & Response 

Emergency Response Team 

Emergency Response Team - Advance Element 

Emergency Support Function 

Extranet Secure Portal 

Evaluation Plan 

Exercise Control Cell 

Exercise National Military Joint Intelligence Center 
Exercise Plan 
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F 

FAA 

FAC 

FAMS 

FBI 

FBIS 

FCC 

FCO 

FD 

FDA 

FEMA 

FOIA 

FOSC 

¥me 

FRC 

FSE 

FSL 

FSLT 

FSLTE 

FTO 

G 

GAO 

H 

HAN 

HAZMAT 

HCC 

HHS 

HOTS 

HQ 

HRSA 

HSAS 

HSC 


Federal Aviation Administration 

Family Assistance Center 

Federal Air Marshals Service 

Federal Bureau of Investigation 

Foreign Broadcast Information System 

Federal Coordinating Center 

Federal Coordinating Officer 

Fire Department 

Federal Drug Administration 

Federal Emergency Management Agency 

Freedom of Information Act 

Federal On-Scene Coordinator 

For Official Use Only 

Federal Resource Coordinator 

Full-Scale Exercise 

Federal, Slate, and local 

Federal, State, Local, and Tribal 

Fronte Salafiste Liberation de Terre Entrangere 

Foreign Terrorist Organization 


General Accounting Office 


Health Alert Network 
Hazardous Materials 
Health Command Center 
Health and Human Services 
Health Operations Tracking System 
Headquarters 

Health Resources & Services Administration 
Homeland Security Advisory System 
Homeland Security Council 
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HSEEP 

Homeland Security Exercise & Evaluation Program 

HSIN 

Homeland Security Information Network 

HSOC 

Homeland Security Operations Center 

HSPD 

Homeland Security Presidential Directive 

I 

lA 

Interagency 

IMP 

Information Analysis and Infrastructure Protection 

lAP 

Incident Action Plan 

IC 

Incident Command 

IC 

Intelligence Community 

ICC 

International Control Cell 

ICD 

Infrastructure Coordination Division 

ICE 

Immigration and Customs Enforcement 

ICEPP 

Incident Communications Emergency Policy & Procedures 

ICER 

Incident Communications Emergency Reference 

ICG 

International Control Group 

ICON 

Information Control System 

ICP 

Incident Command Post 

ICP 

Intelligence Campaign Plan 

ICPACC 

Incident Management Public Affairs Coordination Committee 

ICS 

Incident Command System 

lED 

Improvised Explosive Device 

IIMG 

Interagency Incident Management Group 

IMAAC 

Interagency Modeling and Atmospheric Analysis Center 

IND 

Investigational New Drug 

INR 

Intelligence and Research Office 

INS 

Incident of National Significance 

INT-C 

International Controller 

INTELINK 

Intelligence Link 

IPR 

Illustrative Planning Scenario 

IRC 

Internet Relay Chat 

ISAC 

Information Sharing and Analysis Center 

ISP 

Internet Service Provider 

ISTS 

Institute for Security Technology 
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IT 

Information Technology 

IWG 

Intelligence Working Group 


J 


JFCOM 

Joint Forces Command 

JFO 

Joint Field Office 

JIC 

Joint Information Center 

JIS 

Joint Information System 

JITF-CT 

Joint Intelligence Task Force - Combating Terrorism 

JOC 

Joint Operations Center 

JRIES 

Joint Regional Informational Exchange System 

JTTF 

Joint Terrorism Task Force 

JWICS 

Joint Worldwide Intelligence Communications System 

JWFC 

Joint Warfighting Center 

K 


L 


LE 

Law Enforcement 

LEO 

Law Enforcement Online 

LINGS 

Local Information Network & Communications System 

LNO 

Liaison Officer 

LSG 

Large Scale Game 

M 


M&L 

Maritime and Land Security 

MA 

Mission Assignment 

MARSEC 

Maritime Security 

MCC 

Master Control Cell 

MCoC 

Master Chief of Control 

Ml 

Managed Inventory 

MOA 

Memorandum of Agreement 

MOC 

Mission Operations Center 

MRC 

Medical Reserve Corps 
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MSEL 

MST 

N 

NARAC 

NCC 

NCIC 

NCP 

NCS 

NCSD 

NCRCC 

NCTC 

NDMS 

NEADS 

NEP 

NGA 

NGO 

Nice 

NICCL 

NIMS 

NJ 

NJ LINGS 

NL 

NLIA 

NMCC 

NOAA 

NOC 

NOL 

NORTHCOM 

NPS 

NRCC 

NRO 

NRP 

NSA 


Master Scenario Events List 
Management Support Team 


National Atmospheric Release Advisory Center 

National Control Cell 

National Crime Information Center 

National Oil and Hazardous Materials Pollution Contingency Plan 

National Communications System 

National Cyber Security Division 

National Capital Region Coordination Center 

National Counterterrorism Center 

National Disaster Medical System 

Northeast Air Defense Sector 

National Exercise Program 

National Geospatial Intelligence Agency 

Nongovernmental Organization 

National Infrastructure Coordinating Center 

“Nickel Line” National Incident Communications Conference Line 

National Incident Management System 

New Jersey 

New Jersey Local Information Network and Communications 

System 

New London 

Newark Liberty International Airport 

National Military Command Center 

National Oceanic & Atmospheric Administration 

Network Operation Center 

NCTC Online 

US Northern Command 

National Pharmaceutical Stockpile 

National Response Coordination Center 

National Reconnaissance Office 

National Response Plan 

National Security Agency 
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NSRP 

National Signals Intelligence Requirements Process 

NSRT 

“Nothing Significant to Report” 

NSSE 

National Security Significant Event 

NTC 

National Targeting Center 

O 

ODP 

Office for Domestic Preparedness 

OEM 

Office of Emergency Management 

ONRA 

Office of National Risk Assessment 

OPA 

DHS Office of Public Affairs 

OSHA 

Occupational Safety & Health Administration 

OSIS 

Open-Source Information System 

OSLGCP 

Office of State and Local Government Coordination and 
Preparedness 

P 

PAO 

Public Affairs Officer 

PCII 

Protective Critical Infrastructure Information 

PCR 

Polymerase Chain Reaction 

PD 

Police Department 

PDA 

Preliminary Damage Assessment 

PFO 

Principal Federal Official 

PIO 

Public Information Officer 

PKt 

Public Key Infrastructure 

POC 

Point of Contact 

POD 

Point of Dispensing 

PPE 

Personal Protective Equipment 

PROFLOW 

Procedural Flow Synopsis 

PSO 

Private Sector Office 

PSPG 

Private Sector Planning Group 

PSWG 

Private Sector Working Group 

Q 

QRF 

Quick Reaction Force 
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R 


RDD 

Radiological Dispersion Device 

RFI 

Request for Information 

RRCC 

Regional Response Coordination Center 

RRT 

Regional Response Team 

RSS 

Receipt, Storage, and Staging 

S 

SA 

Situational Awareness 

SAC 

Special Agent-in-Charge 

SARA 

Superfund Amendments and Reaulhorizalion Act 

SARS 

Severe Acute Respiratory Syndrome 

SCO 

State Coordination Officer 

SEOC 

State Emergency Operations Center 

SERT 

Secretary's Emergency Response Team 

SFO 

Senior Federal Official 

SIOC 

Strategic Intelligence Operations Center 

SIGINT 

Signals Intelligence 

S/L 

State/Local 

SIMCELL 

Simulation Cell 

SIPRNET 

Secret Internet Protocol Router Network 

SURER 

Situational Report 

SME 

Subject Matter Expert 

SNS 

Strategic National Stockpile 

SOE 

Senior Official Exercise 

SOP 

Standard Operating Procedures 

SOW 

Statement of Work 

STARTEX 

Start of Exercise 

SUV 

Sport Utility Vehicle 

SVTC 

Secure Video Teleconference 

T 

T2 

TOPOFF 2 

T3 

TOPOFF 3 
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T4 

TOPOFF 4 

TARU 

Technical Advisory Response Unit 

TECS 

Treasury Enforcement Communications System 

TFR 

Temporary Flight Restriction 

TOPOFF 

Top Officials 

TSA 

Transportation Security Administration 

TSC 

Terrorist Screening Center 

TSIS 

Transportation Security Intelligence Service 

TSIS-OC 

TSIS-Operations Center 

TSOC 

Transportation Security Operations Center 

TSOC-CDO 

TSOC-Command Duty Officer 

TTIC 

Terrorist Threat Integration Center 

TTX 

Table Top Exercise 

U 


UA 

Universal Adversary 

UC 

Unified Command 

UCP 

Unified Command Post 

UK 

United Kingdom 

U.S. 

United States 

USAR 

Urban Search & Rescue 

USCG 

U.S. Coast Guard 

USPHS 

U.S. Public Health Service 

USPS 

U.S. Postal Service 

US&R 

Urban Search and Rescue 

USSS 

U.S. Secret Service 

V 


VA 

Veterans Administration 

VBIED 

Vehicle-Borne Improvised Explosive Device 

VBSS 

Visit, Board, Search, and Seizure 

VCC 

Venue Control Cell 

VCoC 

Venue Chief of Control 

VIP 

Very Important Person 

VMAT 

Veterinary Medical Assistance Team 
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T0P0FF3 



VMI 
VNN 
VOAD 
VoIP 
VTC 

W 

WAN 
WMD 

X 
Y 

Y. pestis Yersinia Pestis 

z 


Wide-Area Network 
Weapon of Mass Destruction 


Vendor Managed Inventory 
Virtual News Network 
Volunteer Organizations Active in Disasters 
Non-Voice-over Internet Protocol 
Video Teleconference 
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